
No Macintosh System should be without Mac Zap. 
FULL SCSI Support. Safeguard your SCSI Files! 



Powerful and Easy to use. 
Programs that provide a Macintosh User with SOLUTIONS. 

Recover HFS & MPS 

Mac Zap can Recover files from 




No more Sad Macs. 
Don't let a Crashed 
Disk ruin your Day. 
NEVER Initialize a 
Floppy or Hard disk 
without using Zap First 




damaged or crashed disks. We 
support all disks, MFS and HFS. 
Full Hard Disk support. We also 
support Logical File Volumes 
such as Mac Serve and others. 



Mac Zap System 




Mac Zap Tools is a powerful File and Disk Utility. With this 
program users can edit Disk Volumes, Files, and memory. Other 
windows are a disassembler, Volume & File Allocation maps, 
and a graphics window. Make file storage contiguous for faster 
disk speed. Many other tools! 



Unlock the Power 
of your Hard Disk 



Mac Zap Patcher can install 
protected programs to Hard disks. 
Patch Files are supplied on disk. 
No Key disk needed after a patch. 
Bulletin board support. 



COPY 



Mac Zap Copy makes backup 
copies of protected software. 



Fast Disk Copy is a very fast 
disk duplication program. It 
works with MFS or HFS disks. 



1^ Bulletin Board Support Available 



Compatible with Macintosh 512k, Mac Plus, Mac X/L, MFS & HFS, Hard disks, SCSI Disk Drives, 
Single and Double Sided Floppies, and Network Hard Disk Volumes such as MacServe. 



Copyright 1987 Micro Analyst Inc. 
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Micro Analyst Inc. makes no warranty either express or implied with 
respect to the disk or information provided as to its fitness for any 
particular use. Micro Analyst Inc. will in no event be held liable for 
indirect or direct or incidental damages resulting from any defect or 
omission in the information provided. The user assumes all responsibility 
arising from the use of this product. 
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Use the address below for: 

1) Questions and Problems 2) Ordering New Patches ($10 for a disk) 
3) Ordering Protection Book 4) Ordering MFS/HFS Book 

+ Name and Address and serial number for the Mac Zap disk you bought. 
Also: Your registration card must be enclosed or previously mailed. Your 
serial number is in Mac Zap Tools under the Apple pull down menu, About 
Mac Zap Tools. 

Micro Analyst Inc. 
P.O. Box 15003 
Austin Tx 78761 

Also by Micro Analyst Inc. 

Software Protection Using 
Disk Formatting and 
Operating System Modification 

This is a 180 page book describing the popular software protection 
methods in use today. The mechanics of implementing and removing 
Software protection are described. Sample protection programs for the 
Macintosh, IBM and Apple II computers are included, many pictures and 
diagrams, procedures, guidelines etc.The Six Main Sections are: 

1) Disk Structure from Simple Concepts to Disk Controller Usage 

2) Protection Techniques Used. Software and Hardware with examples. 

3) Protection System Structure 

4) Sample Programs for Mac IBM Applell, Complete Program Listing 

5) Copying Methods, Software Hardware Concepts 

6) Macintosh Chapter 

a) Disk controller 

b) Rom Routines 

c) Sample programs for reading/writing (assembly) 

d) Protection Removal examples and tutorial 

Wire Spiral Bound Price $30 + $3 Shipping ($10 overseas) 
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Macintosh Floppy and Hard Disk Systems 

MFS and HFS Disk Structures 



This Book goes into greater detail than the Mac Zap Manual on the disk 
structures for MFS and HFS operating systems. Some of the sections 
covered in depth are: 



Sector Allocation 
Volume Information 



File Systems 
File Allocation 



Also covered is how the file system works. Block and File Servers are 
explained and network or Lan Servers are explained. Example File I/O 
down to the sequence of events of the Trap call. 



Disk and File Crashes 



SCSI structures 



Memory Structures and reference tables for Disks, Volume Control 
Blocks, File Control Blocks, more 

Great Reference Manual! ! 



SoftBound (Like Zap Manual) 



Price $20 + $3 Shipping 



Software Protection Using 
Disk Formatting 
And 

Operating System Modification 
Macintosh/Applell/IBM 
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Macintosh Floppy and Hard Disk Systems 
MFS and HFS Disk Structures 




IS 



Application Program 



Mac Memory Strucnires 



BleSystoiii 
Read Writa Mount etft>_ 




1.0 Introduction 



You have purchased one of the most powerful and useful utility 
systems for the Macintosh. The Mac Zap System is made up of several 
separate programs and patch files for Mac Zap Patcher. None of the 
programs are protected and can be placed on hard disk drives. 

Send in the registration card for update notification. Your serial 
number is in Mac Zap Tools under the Apple pull down menu, About Mac 
Zap Tools. 

This manual describes the operation of the Mac Zap programs. Along 
with these instructions is some documentation on the Mac Disk system. For 
more in depth information on the Macintosh Disk and File system we 
publish two books, see a description of these books on pages 3 and 4. 

Bulletin board support is available for the Mac Zap system, see section 7.0. 

We recommend you make a backup copy of Mac Zap Right Now ! ! ! 
Note: Mac Zap does not have a System & Finder. 

If you have a 128kMac then: 

A) Boot a system disk, then do a 36 shift 1 to eject that disk. 

B) Insert the Mac Zap Disk and do a 3€ shift 1 . 

C) Insert a blank disk, initialize it, and drag the Mac Zap disk icon 

over the initialized disk icon. 

If you have a 512k Mac or Mac+ then do the following: 

A) Boot a system Disk. Insert Mac Zap and double click on Fast Disk Copy. 

B) Click on (E^^ ^^^^ Memory) Re-Insert the Mac Zap disk 

D) When the entire disk has been read into memory it will eject. 

E) Click on O Format Before Copying 

E) Insert a blank disk in drive 1 and click ( Copy Memory To Disk ) 

A short description of the programs is given below. A full set of 
instructions for each program is in the following sections. 
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TOOLS 
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Mac Zap Tools 

This program gives the user several powerful tools for accessing Mac 
Disks, Files, Memory, Hard disks and Ram Disks. It has multiple windows 
for organizing data and is a powerful utility. The windows are: 
Main Window 

Hex and ascii display of memory and disk blocks. 
Disk & File Window 

Disk & File controls. Access any device, online (mounted) or not. 
Disassembly Window 

A disassembler to screen or file. 
Volume Information Window 

Information and allocation map for a disk Volume. 
File Information Window 

File information and allocation map for a file. Also edit file 

attributes such as invisible and protected. 
Graphics Window 

Display memory as a graphic bit image. Useful when looking at 

disk or memory to tell if it is code, data, or a bit image. 
Data Window 

All search results and information requests will print the 
resulting values in this window. 



In addition to the eight windows there are several pull down menus: 
Resources 

List the resources of a file. Show their location in resource 
fork of file. 
Search 

Enter search strings, Hex or Ascii. Search disk or memory. 
Compare Disks. 
Special 

Unit Table List. Volume List. Multiple block Read/Write. 
Volume Directory Storage Map. 

File 

Search files,Compare files, List files on Volume. Make File Storage 
Contiguous. 
SCSI 

SCSI information 
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Mac Zap Recover 



This program is used to recover crashed disks and files. It will work 
with single or double sided disks and MFS or HFS systems.Hard disks are 
supported also. Full SCSI support. HFS Volume files such as Mac Serve are 
fully supported. 



Mac Zap Recover MFS 
This program is for MFS disk systems and floppy disks. There are 
two windows, one for Hard disks and the other for floppies. 



HF5(3] 



Mac Zap Recover HFS 
This program is used for HFS disk system recovery. Both floppies and 
hard disks are supported. HFS Volume Files supported. 



^M2P| ^ 

PATCH 



Mac Zap Patcher 



This program will automatically remove the protection from 
programs so that they can be backed up. Once the protection is removed 
many of the programs can be executed off of a ram disk or hard disk. Patch 
files are supplied on the Mac Zap disk. As new programs are added to the 
list a new patch file is all that is needed to remove the protection. New Patch 
files can be acquired by the bulletin board or sending in a disk and $10 for 
the latest complete set of patch files. 



copy] 



Mac Zap Copy 



This program will automatically make backup copies of protected 
software. There is a block mode and track or bit copy mode. It can also be 
used on unprotected software. There are also several analysis utilities and a 
track image display/edit/write capability included for advanced users. 



lOFDC 



Fast Disk Copy 

This program copies unprotected software only. It is a copier that does 
fast duplication for single or multiple disks. 
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TOOLS 



2.0 Mac Zap Tools 

->Tutorial in Appendix F<- 



Mac Zap Tools is a powerful set of Disk, File and Memory utilities. 
With Tools you can edit any floppy disk or hard disk, any file or the 
Macintosh memory. The floppy or hard disk do not have to be online 
(Mounted) for them to be accessed. There are powerful dialog boxes 
available for selecting the device you want to read/edit/write blocks to. 

Maps of disk block allocations for volumes and files can be requested 
and drawn. File storage can be made contiguous. These are just a few of the 
resources available to you with Mac Zap Tools. 

When Mac Zap Tools is started the user sees the screen shown below, 
the Main and Disk & File windows are open and visible. 



Main LDindoiu Tools U4.5 



000000 00000000 00000000 00000000 

.0000000 00000000 00000000 00000000 

00000000 00000000 00000000 00000000 

nnnnnnnn nnnnnnnn nnnnnnnn nnnnnnnn 



Disk & File 



[ Driv;er J FFDF (Drive ) 5 
[Disk Biock ) 3 $00000003 

I Up I C 



Open/Close File 



Down 



[ + ] [ Read Disk Block 1 

rz 



Show Disk Buffer 



[ Eject Drvl ] [ Eject Drv;2 
Messages 




Current File 
ISo File Selected 



00000000 
00000010 
00000020 
00000030 
00000040 
00000050 
00000060 
00000070 
00000080 
00000090 
OOOOOOflO 
OOOOOOBO 

ooooooco 

OOOOOODO 
OOOOOOEO 
OOOOOOFO 
00000100 
000001 10 
00000120 
00000130 
00000140 
00000150 
00000160 
00000170 
00000180 
00000190 
00000 IflO 
00000180 
00000 ICO 
000001 DO 
00000 1E0 

00 000 1F0 00000000 0000 0000 00000000 000 000 00 .... . . . . . 

[+] [flDDRESS] n 0000E78fl [ Normal Address 1 [Relative Address! 



g 



(TTT 



Jo 



0 K 
0 K 
$00000000 



Current Uolume 
PLUS-20 
HFS Uolume 

Uolume Size in Kybtes 22016 
Number of blocks 44032 
Number of Files 434 




The other windows are made visible and invisible by the File pull 
down menu. The data window contains results from information requests 
such as file search/compare, disk search/compare or resource lists. When 
any results are sent to the data window by Zap Tools the data window 
becomes the frontmost visible window(if not already). See the other 
sections as to the specifics on the data window. 
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2.1 Main Window 



The Main window contains the Hex and Ascii display area. This is 
where disk blocks will be displayed and the data can be edited. Both Hex and 
ascii are displayed as shown below. 



Main UJindoiu Tools U4.5 



EE440003 fl76F9C13 4fl824000 00100003 
TdFDRCOO 00000200 



BD. .Pou.JCe. . 

.0". 

. . : . .PLUS-20. 



00000000 ^ 

00000010 IDFDflCOO 00000200 00000800 OOOEOOOO 

00000020 0E063fl14 07504C55 532D3230 00000000 

00000030 00000000 00000000 00000000 00000000 

00000040 ooooooog ooogoooo CR080002 B0000002 

00000050 9 — — 

000000604— C .. ... ^^^^ 

00000070 c Memory Address or Relative 0-512, $0-$200 

00000080 c 1 

00000090 0UUUUUU2 — Buuuu ibd — uibyuuuu — uuuuuuuu 

OOOOOOflO 00000000 00000000 00000000 00000000 

OOOOOOBO 00000000 00000000 00000000 00000000 

OOOOOOCO 00000000 00000000 00000000 00000000 

OOOOOODO 00000000 00000000 00000000 00000000 

OOOOOOEO 00000000 OOOGOOOO 00000000 00000000 

00000000 OOOGOOOO OGGGGGGO OOOGOOOO 

Qp/%^^^.»^^ ^j^^^^^^^ ^j^^^^^,^^ 



Hex Data 



OOOOOOFO 
00000100 

00000110 0( 

00000120 0( 

00000130 0( 

00000140 00000000 00000000 OOOGOOOO OOOGOOOO 

00000150 OOOGOOOO 00000000 OOOGOOOO OOOGOOOO 

00000150 00000000 00000000 OOOGOOOO — nnnnnnnn 

00000170 00000000 00000000 OOOGOGC 

00000180 00000000 00000000 OOOOOOC 

00000190 00000000 00000000 OOOOOOC 

00000 mo 00000000 OOOOOOOO OOOOOOC 

00000 1B0 OOOOOOOO OOOOOOOO OOOOOOC 

00000 ICO OOOOOOOO OOOOOOOO OOOOOOC 

000001 DO OOOOOOOO OOOOOOOO ooooood 

00000 1E0 OOOOOOOO OOOOOOOO OOOOOOOO OOOOOOOO 

00000 1F0 OOOOOOOO OOOOOOOO OOOOOOOO OOOOOOOO 



X7X 



o 



Ascii Data 



Scroll Bar, Used for 
moving around in Memory 



o 



[+1 [RDDRESS] F] 0000E38fl [ Normal Address 1 [Relative Address I 

-J — t 1 1 

I Scroll Bar Base I 



Scroll Bar Base 



Relative 0-512, $0-$200 



Enter Memory Address 
for Scroll Bar Base 



Normal Address Printed 



Note: Most values printed in this manual are decimal unless they are 
referenced as hex.. A $ will precede hex values. 
Example 10 Decimal is $0 A. 10 Decimal is hex OA 



Hex and Ascii Editor For Display 

Mac Zap displays 512 bytes of data (size of a disk block) in the Main 
Window on tiie screen. This is called the Display . The contents of a disk 
block are displayed 16 bytes (decimal) $10 (hex) to a row with 32 rows 
making 512 bytes($200) displayed. For each row there is an address on the 
left, 16 bytes of hex and then 16 bytes of ascii. The ascii represents the hex 
data as if it was printed as a screen character. For instance the hex value $41 
is the letter A in ascii. 
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When you read in a disk block the addresses on the left will start at 
0000 and increment up to $01F0 (Hex) by increments of $10. A disk block 
contains 512 bytes (decimal) $200 bytes (hex). 

The disk block can be edited using the mouse and keyboard. On the 
screen there is a cursor (Black Box) on the current hex or ascii byte being 
edited. The cursor in the picture above is in the upper left on the 4 of the 
4244. If the cursor is on a hex number then the user can enter a new hex 
value to be placed at its address in memory. If the cursor is on an ascii byte 
then the user can enter a keypress and its ascii value will be stored. 

To move to a different location on the screen you can move the mouse 
to a hex or ascii byte and click. The cursor will follow you to that location 
and allow entry at that point. 



Memory Display Controls 

In the Main Window there are several controls that can be used to 
display any section of the Macintosh memory. 

The current disk block resides in a 512 byte buffer inside the Mac Zap 
program memory. When you read in a disk or file block the display is set to 
the 512 byte buffer in memory. The addresses on the left are set to relative 
mode, i.e. they start at 0000 and count up to 512 bytes $200. 

The picture below shows graphically that the main window is 
displaying 512 bytes of memory and you can select which 512 bytes by 
using the memory controls. 
$0 



$2000 
$2200 



Macintosh 
Memory 



Mac Zap 
Program 




$FFFFF 



512 Bytes Displayed 




Main Window V4.5 



$2000 3FFE4562 
$2010 6CFE4162 
$20203DDE4232 



DEFCll Disk.af3 
CFFC31 a;dfjllllls 
DEFC41 dioadllsd 



$2200 45873DCF FD23ED adfeSTl 



512 BYTES RESERVED FOR DISK BUFFER 
INSIDE OF MAC ZAP PROGRAM. 
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Address (Used for Memory Display) 

This control is in the lower left part of the Main window. When you 
click on address a dialog box will prompt you for the address to display. 
This address is then used as the base address for the scroll bar. The plus and 
minus controls on either side of the address control will vary the current 
display by 1 byte in either direction, useful for aligning memory to 
graphics or data structures. 

Scroll Bar (Used for Memory Display) 

This is a standard scroll bar like the one you have seen in MacWrite 
and other Applications. It will allow you to move rapidly around memory. 
It has a range of $20000 hex bytes or 128k decimal bytes from the base 
address. The current base address is printed next to the Address control. 

Relative Nortnal 

When a disk block is read the display shows the contents of the block. 
Because you have read in a disk block the addresses on the left of the display 
go from 0000 to $01F0 (512 bytes). The Normal Button will display the 
normal address values as if you were displaying memory. The relative 
button puts the 0000 to $01 FO address range up and can be used at any place 
in memory. It is useful if you are looking at structures etc... 
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2.2 Disk & File Window 
This window is used to select which device (Floppy, Hard Disk, etc) or 
file you will read blocks from. The window below is what you will see on 
program startup. 



Disk & File 



I Driver j FFDF [Drive ] 5 
[ Disl< Blocl< ] 2 $00000002 



C 



Up 



J c 



Down 



[ + ) [ Read Disk Biock~~] 



Show Disk Buffer 



A C 



Ur i te D i sl< B I ock 



( Eject Drvl ] [ Eject Drv2 
Messages 



Open/Close File 

*f=| Current File 

I I fel No Fi I e Selected 

QOaia Fork 0 K 

® Resource Fork 0 K 

[Fi le Position ) 0 $00000000 



■or 
EH 



Current Uoiume 

PLUS-20 

HFS Uoiume 



Uoiume Size in Kybtes 22016 
Number of blocks 44032 
Number of Fi les 433 



Error or other messages printed here. 
Click inside box to erase current mssgs. 



In the window above, the icon 



has a box H next to it with an 



arrow inside. Above this there is another icon o— ) that has a box with no 
arrow in it. The arrow decides whether you are reading a Volume 



ur 



or 



a file 




By clicking in the box next to the icon you switch from one mode to the 
otiier. Try it now, just click in the box next to the '^-^ and you will 
switch from volume mode to file mode. Click in the next to the 



or 



and you will switch back to volume mode which we will cover first. 
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Volume Read/Write Blocks 



Next to the 



I I 1 : 



icon is the current volume name and some 
information on that volume such as MFS or HFS type, number of files, 
number of blocks. 



If you click on the ^CHI icon Mac Zap will cycle through all of the 
mounted volumes, advancing one volume for each time you click. 

On the left hand side of the Disk & File Window is a set of controls for 
reading and writing blocks. We will skip the first two controls, Driver and 
Drive for now and cover the other controls in sequence. 

The first control is I P'^*^ Block] ^ jq ^^e right of this control are two 

numbers, they are the same value printed in decimal and then hex. This is 

the 'current block' that will be read or written. To enter a new value you 

can click on the [ D's^ Biockj ]3utton and a dialog box will ask you for a 

number, you can enter a number in hex or decimal. 



The next controls are the ( ) andl "Q"^" ) buttons. 

These buttons increment and decrement the current block (above) by one. 
The next control [ Read Disk Block ) y^iii j-ead the current block and 



display it for you in the main window. The control will first 

increment the current block by 1 and then read a block. The control 
will decrement the current block by one and then read a block. 

On the next row down we have 1 ^^^'^ ^'^^ ^"^^^'^ ) .As 

mentioned previously the Main window can also be used to display memory 
as well as disk blocks. If you are displaying another part of memory and 
want to look at the disk buffer this control will bring the display back to the 
disk buffer. 

The next row has an icon fi of a lock. This is a lock on your write 
control. We don't want you accidentally writing to a block when you don't 

want to. If fl is showing then the write control is disabled and you cannot 

write. By clicking on you change it to rf* the unlocked state and you can 

tbf.n [ l^r i te D i sk B I ock ] ^ 

The last two buttons are used for ejecting floppy disks. The 
[ Eject Drvi ) button wiU cject drive one and similar for drive 2. 
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Now we come to the 1 O'^'^^r ) [ Drive ) controls. These controls 
are for advanced users that want direct access to the device drivers. Normal 
use of Mac Zap Tools will not require the use of these controls to edit any 
mounted volumes or files. 



When you selected a volume using the 



icon the driver number 



and drive number were automatically set for you. Their values were 
printed next to the 1 O'^'^er ) andC^El^ controls.To set these values 
yourself click on either control. 

If you click on the [ Driver ) control the dialog box below appears: 



Unit Table List 
Select the DriuerTo Use 



O .Sony 
O -Song 
O -MacHost 
O .Keeper 
O Kpnt DRUR 
O.Peak SCSI 
O 

O NDni> 
O None 
O Noj[U> 
O Non^> 

OSCSI Disk Driue 
O Apple HD20 

O User Entered 

/ \ 

Cancel 



OK 



With this dialog you can select any of the device drivers listed in the 
unit table (those drivers recognized by the Mac). In the example above 
some of the the drivers are Sony (Floppy disks), Peak SCSI (Hard Disk), 
and .Keeper (Hard Disk). 

Alternatively you can select a SCSI driver inside of Mac Zap Tools 
with O SCSI Disk Driue , the Apple HD20 driver, or enter your own 

driver value O User Entered 
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If you select the SCSI Disk Drive option you will be prompted for 
which SCSI device number to use. The Drive number (note DRIVE not 
Driver) is then set to this device number. Now when you read /write disk 
blocks you will go directly to the SCSI disk drive and not be limited to the 
volume partition. This SCSI driver is imbedded in Mac Zap Tools. 



By clicking on the t ^'"^'^^ 1 control you can set the drive number 
yourself. The dialog box shown below appears. 



LDe need to know what driue number to use. 
Some Common Numbers. 



Possible Driue Numbers 
For this Deuice Driuer 



HD20 Driue»3 
Lisa Dr[ue=4 
HyperDriue Boot 
Uolume Driue='100 



Driue Uoiume Name 
5 PLUS-20 



I 



^ If St of possfhle drive numters. 



Driue 
Number 



OK 



Cancel 



Enter the drive number you want to use and click OK. 
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File Read/Write Blocks 

We have just covered how to use the Disk & file window for editing 
disk volumes. To edit files click in the next to "^--5) which will select file 



mode Click on to open a file. A standard file select dialog box 
will appear and you can choose which file to open. If you click cancel in the 
file select dialog box then any current file is closed and no new file is 
opened. Mac Zap will not open any files already opened for writing. 

In the example below the imagewriter file resource fork has been 
opened. Note that the controls on the left side of the window are now setup 
for file editing. Instead of Disk block you have File Block and instead of 
read disk block you have Read File Block, etc 



Disk & File 



( 0:- 1 FFDF I 0«-»-'<? 1 5 
( File B I ock ) 0 $00000000 



C 



Up 



D C 



Down 



J 



[ + 1 [ Read Fi le Block ] [ - ] 
[ Show File Buffer ] 



I Uri te Fi le Block j 



Messages 



Open/Close File 

Current File 

["►l I mageWr i ter 

OData Fork 0 K 

(i) Resource Fork 30 K 
[ Fi le Position ] 0 $00000000 



□ IP 



Current Uolume 

PLUS-20 

HFS Uolume 



Uolume Size in Kybtes 22016 
Number of blocks 44032 
Number of Files 439 



The File Position control below the oin) is used if you want to read in 
a known position in the file. The File block and File position values are 
linked. For Example, if you set the File Position to 680 the File block would 
change to 1, because block 1 contains File position 512-1024, There are 512 
bytes per file block, just as there are 512 bytes per disk block. Next to the 
control is the current file position, printed in decimal and then hex. 

To open the data fork of a file just click on the Data Fork Control 



below the 
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2.3 Volume Information 



The next picture shows the Volume inforniation window. At the top of 
the window is the disk name and a button labelled Drive. This button is used 
to obtain information on mounted volumes and an allocation map is drawn. 

The information displayed and the labels will differ slightly between 
MFS and HFS volumes due to their different structures and contents. See 
appendix C for more detail on volume info block structure. 

For HFS Disks the map is for allocation blocks, not disk blocks. An 
allocation block is the BLOCK of disk space that is allocated to a file when a 
file needs more space to grow. On smaller disks, say 20 Meg or less one 
disk block = 1 allocation block. On larger disks there are several disk 
blocks per allocation block. The reason for an allocation block map rather 
than a disk block map is due to the size of the hard disks. A hard disk may 
have as small as 20,000 disk blocks for a 10 Meg or over 160,000 disk 
blocks for an 80 Meg hard disk. On hard disks the allocation block size is 
manipulated such that the total number of Allocation blocks is between 
20,000 and 55,000. In the 80 Meg example above we could map 3 disk 
blocks to 1 allocation block and end up with 53,000 allocation blocks. 



Uolume Information 



Drive ] flilocation Block Map For DISK — >PLUS-20 



Number of flilocation Blocks 
Number of Disk Blocks 

00 32 64 96 128 



30720 



36864 



43008 



> 44032 
> 44032 

160 192 



Disk Blocks per flilocation BIk >1 
Disk Blocks Per Row >384 



224 256 288 320 352 




"t"^^ Real Time Block Pointer 



Map 



Currently pointing 
UOLUME ATTRIBUTES >4000 
NUMBER OF FILES >436 
FIRST BLOCK OF UOLUME BIT MAP >3 
NUMBER OF DIRECTORIES ON UOLUME >59 
START OF ALLOCATION BLOCKS > 14 

NUMBER OF UNUSED flLLOCflTION BLOCKS > 14789 



at Block > 36887 

SIZE OF ALLOCATION BLOCKS 
NUMBER OF BVTES TO ALLOCATE 
NEXT UNUSED FILE NUMBER 
INITIALIZED >18:31 



Hex $00009017 

>512 
>2048 
>3593 
01/03/04 



BACKED UP ON > 19:56 12/22/86 

HFS Uol Size KBytes Dec 22016 
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2.3 File Information Window 



When opened the user can select a file and display information on it. A 
standard Macintosh File selector dialog box will appear as shown below: 







Clipboard File <! 

DeskTop 

Finder 

Imageiuriter 
MacPaint 
MacLUrite 
Scrapbook File < 


> 


MacUlrite/P... 






Eject ) 




Cancel 


[ Driue 


> 









NOTE: On Finder 5.0 or later the dialog box will be slightly different. 

To select a file you can click once on the file and then on open or you 
can double click on the file name itself. There are two buttons in the upper 
left of the File Info Window: 

NewFUe 

Select a new file to display information on. 
Update 

If you change file information and want to update the file on the disk 
click here. 

The example below is on an HFS volume. HFS Files are stored in 
EXTENTS, (a contiguous series of disk blocks). There can be 0 or several 
extents for each file fork. Each fork of the file has its extents listed on the 
right side of the screen. Each extent of a fork is listed as two values, IstBlk 
and #BIks. IstBlk is the starting disk block of the extent, note that it is the 
true disk block and not an allocation block. #Blks is the number of disk 
blocks that this extent contains. If there are more than 3 extents a message 
'+++ More+++' is printed beneath the 3rd extent, these are very 
fragmented files. 

The file extents are also mapped graphically in the volume map. Above 
the map is information on the volume that the file is stored on, such as the 
number of disk blocks, allocation blocks etc... .For more information on the 
file structure see Appendix D. 
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Note: Under the ExtrarFile pull down menu there is an option to make 
a file's storage contiguous (only one extent per fork) in that menu. This 
reduces access time on the file and speeds up disk operation. Typical files 
that can use this are the system file, desktop and any large data files you 
have on disk. 



File Information 



New File Update 



Allocation Map For FILE — >DeskTop 

On Uolume ->PLU$-20 
Number of fll location Blocks >44032 Disk Blocks per Allocation BIk >1 

>384 



Number of Disk Blocks 
00 32 64 96 



6144 



12288 



18432 



24576 



30720 



36864 



43008 



128 



> 44032 
160 192 



Disk Blocks Per Row 
224 256 288 320 352 



-Disk Block 19612 



128 Disk Blocks Long 



File is Located here on the disk. 
Resource Fork 



44032 Allocation Blocks 



Data Extents 
IstBlk «Blks 



Rsrc Extents 
IstBlk «Blks 



19612 128 



Currentl y pointing at B l ock > 9299 H ex $00002453 

[ NOT LOCKEDI [ INUISIBLE ] [ NO BUNDLin [ NOT SVSTEn ] [UNPROTECTEDI 



Starting fll location BIk of Data >0 

Data Fork Logical End of File >0 

Data Fork Physical End of File >0 
Starting fll location BIk of Resource>0 

Resource Fork Logical End of Fi le > 54405 

Resource Fork Physical End of File >65536 
Finder data > 400000790 1CB0000 



File F I ags 
Uersion Number 
File Number 
Date Created 
Date Modi f ied 



>00 
>00 
>3431 

> 18:31 01/03/04 
>19:52 12/22/86 



[ Type ] FNDR [Creator] ERIK 



The control buttons beneath the allocation map allow you to edit the 
Type and Creator fields and set other file data. The 5 buttons below the map 
allow you to set the file as : 



Lock the file for Deletion 
Is the File Visible on Desktop 
Does the File have Bundled Resources 
Is it a system file 

Is the file protected from copying?(MFS only) 
Enter a new 4 character Type field. 
Enter a new 4 character Creator Field. 



Locked/Unlocked 
Visible/Invisible 
Bundle set/No Bundle 
System/Not System 
Protected/Unprotected 
Type 
Creator 
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2.5 Disassembly Window 

This window has similar controls to tiie Main Display window. At the 
current address 32 lines of disassembly are displayed. The address controls 
enable you to move around in memory. To disassemble a disk block, read in 
the block and click on [ O'sk BuffeT] ^ position the disassembly window 
to the same address as the Main display window click on [Main Display] ^ 

On the bottom line of the window are controls used to send the 
disassembly listing to a file for printing and editing. The leftmost part of 
the window either says OFF (no file opened for listing) or ON (a file is 
opened for listing). To o pen a file for listing the disassembly to, click on 
(Open File f or Listing ) ^ you wiU be prompted to name the file. Click on 
[Close Fi ie] when you are finished listing to a file. To list a range of 
memory to the file or to the display window you can click on [List Range) 
and specify a from/to range for listing. 



I i s a s s e m b I y JUindouj 



0107B0 
0107B2 
0107B6 
0107B8 
0107BE 
0107C0 
010702 
0107C4 
010706 
0107Cfl 
0107CC 
0107D0 
0107D4 
0107D6 
0107Dfl 
0107DE 
0107E0 
0107E2 
0107E6 
0107En 
0107EE 
0107F2 
0107F4 
0107F6 
0107Ffl 
0107FC 
010800 
010804 
010806 
010800 
01 0800 
010810 



42fl7 

3F3C0102 
42fl7 

2F3CFFFFFFFF 

fl97C 

2C1F 

2F06 

0873 

41Ffl1BB8 
2086 

303C0003 

4EBfl0482 

2007 

eiOOFIflE 

2F3fl1Bflfl 

2F0B 

fl98F 

2F3ft1B9C 

3F3C0003 

3F3C0000 

3F3C0014 

fl97E 

4207 

4870 1C40 

0991 

30301030 
0C40000 1 
6734 
00400004 
6614 

303C0003 
4EB00442 



CLR.L -<07> 
nOUE.U «258.-<07) 
CLR.L -<07^ 
MOUE.L «-1,-<07> 
-jGetNewDialog -4— 
MOUE.L <07)?^D6 
MOUE.L D6,-<A7) 
^etPort 



W 
?< 

BO 



Trap Calls by Name 



$00012380<PC>,00 
D6,<00) 
«3lD0 
060 1 0054 < PC) 
7^00 
06F986 

00012386<PC),-<07> 
3 -<07) 



LEO.L 
MOUE.L 
MOUE.UI 
JSR 

MOUE.L 
BSR.L 
MOUE.L 
MOUE.L 
-jSetlTex^ 

MOUE.L |00012380<PC),-<07> 

MOUE.W «3 -<07> 

MOUE.W «0l-<07> 

MOUE.W «26,-<07> 
-Sell Text 

CLR.L -(07) 

PEO.L $00012438<PC) 
Jloda I D i g I CO 

MOUE.W $000 12438 <PC). DO 

CMP . W « 1 . DO 

BEO.S $010830 

CMP . W «4 . DO 

BNE.S $010820 

MOUE.W *!3.D0 

JSR $00010054 (PC) 



ODOTT 
U 



Ascli 



|T| [0DDRES$] F) 00010000 [Main DlspTo^ [Disk BuffirH 



?< 
?<D 

1^ 

HzDS 

S>e 

0:D: 

D@ 

o4 

09 

fD 

0^ 
NJB 



OFF [open File for Listing^ [List Range ] [ C I ose File] 



No File Open for Listing 
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2.6 Graphics Window 



This option will allow you to display memory as a bit image (see 
Quickdraw in INSIDE MACINTOSH for more detail than here). A bit 
image is a block of hex data. The picture below shows a simple bit image. 
One byte is 8 bits. For this example there are 9 Rows and 1 byte/row. 
NoteiQuickdraw requires you to use an even number of bytes per row!! 



Hex 

00 Simple case: 

18 1 byte per row 

3C 9 rows. 
7E 

24 Every wh i te square 

24 is a zero, every 

7E blacl< square is a 

00 one . 



iD lZIZI = | p Graphics LUindouj 

[ Bytes Per Row J 04 [ Inc ] [ Dec | 



Main Window Data is displayed as 
Graphics with 4 bytes/row. The Main 
window for this example has a block 
out of the desktop file, so you see 
icons displayed. 



There are two Active Button Controls in the Graphics Window: 

INC 

Increment the Bytes/Row value - this value is displayed to the left of 
the INC and DEC controls. 
DEC 

Decrement the Bytes/Row Value 

The top row of the bit image displayed starts at the first hex byte of the 
main window display. If you move the main window display (using the 
memory controls) or read in a disk/File block the graphics will change. 
Use the + and - controls on either side of the Address control (Main 
Window) to change the starting point of the display by one byte. 



8 bits 
I mage 



4 



B i nary 
0000 0000 



0001 
0011 
0111 
1010 
0010 
0010 
0111 
0000 



1000 
1100 
1110 
0101 
0100 
0100 
1110 
0000 
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2.7 Menu Bar Options 



The menu bar of Mac Zap Tools has many different options. Some of 
these options are map resources of a file, search files, search disks, search 
memory, make file storage contiguous and many more. 



The information stored in the resource fork of a file is called 
resources. There are many types of resources and developers can define 
their own new resource types. Examples of resources are: 



The option under Resources is 'File Resource List' which will give a 
resource list and map of a file. The user is prompted for a file to perform 
this operation on. The resource map is output to the data window. 

An example output is shown below, all values are HEX: 



File Name Myfile 
File Attributes 0013 
Number Resources 3 

TYPE ID# ATTR OFFSET SIZE NAME 

CODE 0000 0000 001000 00004C Jump Table 

CODE 0001 0000 001050 000010 MY APPLICATION CODE 

Start offset= 00000008 
PICT 2344 0000 001064 OOOFEO MY MAC PICTURE 



2.7.1 Resources 



DLOG 
CODE 
PICT 
STR# 



Dialog definitions, such as GetFile Dialog 
Machine code. Application code for example 
Pictures 

Strings, used in prompts etc... 
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After the file name, attributes and number of resources comes a list of 
resources. The list's 6 columns are explained below: 

TYPE 4 byte type of resource 

Note: Code 0 is jump table for application. All other 
Code segments will have their initial start offset address listed. 

ID# 2 byte id # of this resource 

ATTR Resource attributes 

OFFSET Offset from beginning of file to start of 
this resource's data. 

SIZE Size of this Resource 

NAME Name of this Resource (User name, may be blank) 

SEE INSIDE MACINTOSH FOR MORE INFORMATION. 



2.7.2 Search 

This menu has several options, all of which deal with search 
operations. In a search operation Mac Zap will search (Disk , File , or 
Memory) for a target string (search string) which can be Ascii (Text) or a 
number. The different options are described below, in reverse order. 

Enter Search Range 

The user is prompted with a dialog box to enter the starting search 
position (From) and the Ending search position (To). The values entered 
should be in Hex. 

See the Special pull down menu option 'Hex<-> Decimal Conversion' 
if you need the hex value of a decimal number. 

Show Search String Area 

This option is not needed by normal use of Mac Zap Tools, it will 
display a section of the Mac Zap Tools program where the search string is 
located. 
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Enter Ascii Search String 

The user is prompted for a search string, enter any text that you want 
to search for. An example is 'Welcome'. See the tutorial in appendix F. 

Enter Hex Search String 

The user is prompted for a search string, enter any number in hex that 
you want to search for. An example is '4244'. 



Compare Disk Blocks and Tags 

This option will compare disks in the internal and external disk drives. 
Any differences in the disks will be printed in the data window. Not only 
the disk blocks are compared but the file tags also. 



Use 



EZl 



and set the current volume in the Disk & File window to 
either of the two floppy disks in the internal and external disk drives. Set 
the Search Range to the area of the disk to be searched. 

Each difference between disk blocks will be printed as 8 characters, 
the first four characters are the relative location in the block and the next 
four are the block. Only the first difference in each disk block will be 
printed. The numbers are in Hex. 

♦ 

For example: We compare disks blocks between $130 and $168. 

Output to data window: 
Compare Disk 

00140134 01580168 Hex 



The first number was 00140134, which means that at 
byte $14 (0Q140134) on block $134 (0014 0134^ there was a difference 
between the blocks. The second match was 01580168 which means that at 
byte $158 on block $168 there was a difference. 

File tag differences will have similiar output but will start with an F. 
Example: Output to data window: F0020134 

The number was F0020134, F means file tag difference at byte $2 on 
block $134. 



NOTE: Two Drives Needed. Hitting O will terminate the Compare. 

Compare Disk Blocks 

This is the same as above but File Tags are not compared. 
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Search Disk 

Using the search range Mac Zap will search the current volume for 
any matches to the search string. Any matches will be printed in the data 
window. 
For Example: 

Search Range From=0 To=$10 

Will search the current volume from block 0 to block $10 for the search 
string. Matches printed to the data window, in hex format. 

Search Disk for xxxxx 
00140000 00A00002 OllOOOOE 

This means: 

Matches were found at: 

00140000 Relative Byte $0014 
00A00002 Relative Byte $00A0 
OllOOOOE Relative Byte $0110 

NOTE: Hitting O will terminate the Search. 

Use the Hex to Decimal Conversion in the Special Pull down menu if you 
need the decimal value for any hex number. 

Search Memory 

Using the search range set Mac Zap will search memory for the search 
string. Any matches will have their full address in hex printed in the data 
window. 

2.7.3 Special 

This pull down menu contains several different options described next. 
Volume List 

List all of the currently mounted volumes that the Mac recognizes in 
the Data window. 

Unit Table List 

List the table of device drivers (called the Unit Table) to the Data 
window. The driver reference numbers, names and memory addresses are 
printed. 



on block $0000 
on block $0002 
on block $000E 
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Read Multiple Blocks 

Read 10 blocks from the current file or volume, whichever is selected 
in the Disk & File window. The 10 blocks will be read from the current 
block location. They are read into a big buffer inside of Mac Zap Tools. 
With this you can disassemble large portions of files, look for large 
graphics, or see large portions of a disk at a time. 

Write Multiple Blocks 

Write 10 blocks to the current file or volume, whichever is selected in 
the Disk & File window. The 10 blocks will be written starting at the 
current block location. They are written from the big buffer inside of Mac 
Zap Tools. 

Multiple Block Buffer 

This option will set the main display (hex and ascii) to the big buffer. 

Current Volume Info Block 

This option will print the location of the directory on the current 
volume. The first block of the directory and the number of blocks in the 
directory is printed in the data window. The numbers printed are in 
decimal. 

HFS volumes may have a fragmented directory, in that case, for each 
fragment Mac Zap will list the first block of the directory and the number 
of blocks in that fragment. This is useful for directly accessing the 
directory on a disk. 

Hex & Decimal Conversion 

This option provides a method for conveting between Hex to decimal 
and vice-versa. 



2.7.4 Extra:File 



This menu has additional utilities for working with files. 
Search Files 

The user is prompted for a file, then that file is searched for the search 
string. The fork set in the Disk & File window is used. If there is a file 
currently opened for editing it will be closed. For every match the relative 
offset from the beginning of the file is printed in hex in the data window. 
Hitting a Q will terminate the search. 
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Compare Files 

The user is prompted to select two files, using two sequential file select 
dialogs. For every difference between the two files the relative address 
from the beginning of the file is printed in hex in the data window. The 
fork set in the Disk & File window is used. If there is a file currently 
opened for editing it is closed. Hitting a O will terminate the search. 

Volume File List 

All of the files on the root level of the volume are printed in the data 
window. In between the file name and the last modification date is printed 3 
of the files attributes: 

I If the file is Invisible 
P if the file is Protected 
L if the file is Locked 

2.7.5 SCSI 

Mac Zap has powerful SCSI tools including an independent SCSI 
driver inside of Mac 2^p. If a SCSI hard disk is offline or will not mount 
Mac Zap can still access the disk via the built in Mac Zap SCSI Driver. 

How do you turn on the driver?? In the Disk & File Window there is a 
button labelled Driver, on the top left side of the window. When you click 
this button Mac Zap will ask you which driver to use. Click on the option 
SCSI Disk Drive (above Apple HD20). This will set the internal Zap SCSI 
driver. The drive number is now the device number that Mac Zap will 
access on the SCSI bus. 

When Zap reads or writes a block with it's own SCSI driver it will not 
limit you to the volume partition, you can access any block on the SCSI. 

SCSI Information Dialog 

This dialog contains information on the Zap tools available for SCSI. 

Driver & Partition Info on SCSI 

When this option is selected Mac Zap will print Driver and Partition 
info on the SCSI device currently set. Remember that the Drive number is 
the SCSI device number also. 

Mac Zap will print the number of Drivers found, the partitions on the 
SCSI and the sizes. 
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3.0 Mac Zap Recover 



Mac Zap has a very powerful disk and file recovery system. The recovery 
system is actually two programs, Mac Zap Recover and Mac Zap Recover HFS. 



The first program 



is used for MFS floppy/hard disks and can also be 



used for HFS Floppy disks. 



The second program is used to recover HFS floppy /hard disks. This 

program can also recover Volume Files such as Mac Serve and others. 



NOTE: In a few cases your disk may be recoverable without Mac Zap, be 
sure to see section 3.1 'Things to try first*. 

NOTE: If you want to recover a floppy disk we recommend you copy the 
damaged disk using Mac Zap Copy and use the copy as the work disk while 
recovering a file or disk. With the original disk untouched you can make more 
copies if you have to. 



3.1 Things to try First 

In the following discussions we will use the term volume. A volume is a 
floppy disk or a hard disk. It is a logical device that stores files. When we say 
mount the volume it means the same thing no matter what type of device you are 
working with. To mount a floppy disk volume you insert the disk in the Mac, the 
operating system takes over and 'Mounts' the disk volume. For hard disks there 
is usually a mount manager utility to mount volumes on the hard disk. For SCSI 
devices when you turn on the SCSI it will usually try to 'Mount' the startup 
volume. 

If the quick fixes described below do not work then use the Mac Zap 
Recover programs. 



If the the volume is MFS then use 



Mac Zap Recover. 



If the volume is HFS then use Mac Zap Recover HFS. 
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Things to Try 

Turn off the power and insert a normal undamaged system disk, such as a 
disk with MacWrite or MacPaint on it, in the Mac's internal drive and turn on 
the power to your Mac. When you are at the desktop hold down the 3€ and 
option keys while you insert the damaged disk (or mount the damaged hard disk 
volume), this rebuilds the desktop which is a common problem. 

If the volume does mount and you can access your files then quit, rebuilding 
the desktop solved your problem! 

If the Mac wants to initialize the volume or the Mac crashes, then rebuilding 
the desktop did not work and the problem is more severe. There is one more 
approach to try before using the Mac Zap Recover programs. 

Try moving the files off of the bad disk under the control of an application 
program such as MacWrite, a Database program, MacPaint etc.... depending on 
what type file it is. 

Example . Your disk is bad and there is an important MacWrite file MyFile 
on it. Start MacWrite up on a good disk and then insert your bad disk into a disk 
drive and try to load MyFile. If MacWrite does not recognize the disk use one of 
the recover programs, otherwise try to load the file MyFile. If the file loads 
normally you can save it to another disk that is undamaged. If the file is 
recognized but does not load, or only partially loads and reports an error at 
some point, use one of the recover programs. 



3.2 Mac Zap Recover MPS 



This program recovers lost files and crashed disks or hard disks.The 
purpose behind the recover program is to allow you to recover your important 
files on a disk. Once a disk has crashed we recommend that you move the 
recovered files onto a freshly initialized disk that you know has no problems! 
Hard disk volumes should be handled in a similar fashion. If you have a damaged 
MFS floppy then see section 3.2.1. If you have a damaged MFS Hard disk 
volume se.e section 3.2.2. 
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3.2.1 Floppy Window 



Below are the Quick Operating Instructions for the Floppy Window, for 
more detailed information on the program see the selection after the Quick 
instructions. For deleted files (Files thrown in the trash can) see the second set of 
Quick operating instructions. 

Quick Operating Instructions for Crashed or Damaged Floppy Disks 

A) Insert the disk, set Internal/External drive and press Scan Disk. 

B) Fix any messages that are printed in the prompt box by 

clicking Fix Messages. 

C) Mac Zap will try to repair any problems found and then mount the disk. 

If Mac Zap cannot mount the disk proceed to option E below. 
A message will tell you if the disk mounted or not. 

D) If Mac Zap could mount the repaired disk quit from Mac Zap. 

Then insert a blank disk, and move your files to the 
blank disk. If you cannot move your files proceed with E. 

E) If the disk is not fixed or you cannot access your 

files then set the following options. (Options pull down menu) 

Rebuild Allocation Blocks 

Clear Directory 
Put the damaged disk in and Click on Scan Disk again. 
After the scan, click on Fix Messages. 

F) In the bottom of the Floppy recovery window is a display box that 

will print all of the files found on a disk when a scan is done. 
Select one of these files to recover by clicking on it. 

G) Set the Type and Creator. 

(Macwrite,Macpaint,Application, or Scan by button) 
(You also can set any type and creator using the 
parameters pull down menu). 

H) Click Recover File. The file will be rebuilt and a new 

file name, printed in the prompt window, assigned by 
the Recover program. This is the file to move to another 
undamaged floppy. ALL recovered files begin with RZ, 
other files may not be intact! 

Loop to F for all of the files you want to recover. 

Move the RECOVERED files that are named RZxx to an undamaged disk! ! 
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Quick Operating Instructions for Deleted Files (Floppy disk only) 

A) Insert disk, set Internal/External and press Scan Disk. 

B) Goto F in the previous procedure. 

Note: The file you want will not be in the directory, therefore it will 
not have a name. You will have to look at file sizes, dates etc to decide 
which file to recover. Set the type and creator. If you just deleted the 
file and have not worked on the disk then only look at those files that 
have OK = Y as your file should be intact on the disk, but not entered 
in the directory. 

Detailed Information on Floppy Window 

The following picture shows the Floppy Disk/File Recovery window. 



Floppy Disk/File Recouery 



Scan Disk 



® Internal Driue 
O EKternal Driue 



Messages [ {\h M<n.s<i<|(n | [ Help ] 



Ooo 



® Application 
OMacUJrite 
O MacPaint 
O Other Type Creator 

[ MI^S IU>coucr ri(^> No File TypezRPPL Creator:???? 

Num OK Size Peso Miss Data Miss Type Date Dir Name 



o 



Mr$/m<> t::HU'<HXFi\(i 1 [Destination Uolume 1 Untitled 



ScanDisk 

This option scans a disk and looks for several error conditions. If any 
errors are found it prints a message for each in the prompt box and enables the 
Fix Messages button. You can force certain fixes to be performed no matter 
what by using the Options pull down menu, see the next section. Once the scan is 
done you can fix any errors (click Fix Messages). 
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When a disk is scanned a list of all files that were found during the scan is 
made, and displayed to you after the scan. Column headings of the file list are: 

Num File Number 

OK Is the file intact (all blocks present) Yes or No 

Size Size, number of 5 1 2 byte blocks 

Reso Number of Resource blocks found 

Miss Number of missing Resource blocks 

Data Number of Data blocks found 

Miss Number of missing data blocks 

Type If the file was in the directory its Type is displayed 

Date The latest access date to this file 

Dir Was the file (number) in the directory? Yes or No 

Name If it was in the directory what was its name 

This information is supplied to you to help you decide which files to 
recover. Recover your important files and move them to an undamaged disk. 

Fix Messages 

If any errors in the disk are detected during the scan Mac Zap will give you 
a message and enable Fix Messages. Clicking on this button will tell Mac Zap to 
try and fix the errors detected. After Zap is finished it will try to mount the disk 
and tell you the result. If it could mount the disk exit from Mac Zap and try to 
access your files. Move them to an initialized disk if possible. 

If you cannot move the files then there are more severe problems. Run Mac 
Zap Recover and start at option E in the quick operating instructions. 

Application MacWrite MacPaint Other Type Creator 

These buttons set a Type and Creator for a file that is being recovered. The 
'Other Type and Creator' control will bring up a dialog box with other popular 
application programs. In the Other dialog box is also an option for 'Scan Values 
in List'. If this is set then the Type and Creators found when the disk was scanned 
will be used. If there is a filename in the Hst then this 'Scan Values in List' setting 
should be used. 

As a final choice there is a menu bar called Parameters with which you can 
set any Type and Creator you choose. A dialog will prompt you for the 4 
character values. 
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Recover File 

The disk must mount for this button to function. The recovered file is 
rebuilt and stored on the disk it was found on. To move a rebuilt file off of the 
bad disk onto another good disk see Extract File option below. The 'Extract File' 
option is for those disks that will not mount. 

This button will rebuild a file once a disk has been scanned. See Scan Disk 
detailed previously for a description of the file data presented. Set the type and 
creator of the file to be recovered, see the previous controls. Select a file in the 
list with the mouse and click Recover File. The file will be rebuilt and given a 
new name on the disk. All recovered files begin with RZ....Example: RZOO, 
RZOl, etc. Move the recovered files off of the damaged disk to an undamaged 
disk. 

MFS/HFS Extract FUe 

The Recover File button above depends on the disk being able to mount for 
it to function. In some cases Mac Zap may not be able to mount the disk even 
after repairs are made. In that case you can extract the file to another good disk 
using this control. 

First set the destination volume, this is where the file will be moved to. Use 
the Destination Volume button to do this. Select a file in the list with the mouse. 
Click MFS/HFS Extract File and wait.... The file will be moved onto the 
destination volume. 

This option works on Single or Double sided disks and MFS or HFS 
formats. The file tag data is used to build the file so this can also be used for HFS 
although we recommend you first try the Mac Zap Recover HFS program for 
HFS disks. 

Menu Bar Options 

Parameters 

When the floppy window is active the user can use this pull down menu to 
set any Type and Creator he chooses. Dialog boxes will prompt for the 4 
characters needed. These should be used if none of the known defaults are the 
file you want. 

Options 

The options under this menu can be selected (checkmarked). Then, when 
the Fix Messages button is clicked they will be done by Mac Zap no matter what. 

Clear Boot Blocks 

Write zeroes in the blocks 0,1. Makes the disk non-booting but 
solves some problems. 
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Rebuild Allocation Blocks 

Rebuild blocks 2,3 to the initialized fresh disk state. Solves 

bad allocation or volume block problems. 
Clear Directory 

Writes zeroes in blocks 4-F. Solves bad directory block 

problems. 
Kill Desktop 

Changes the name of Desktop to Desktop. The system will then 
rebuild the desktop. Solves boot and desktop problems. 
Fix Bad Blocks 

Try to correct bad blocks to an error free state. 

3.2.2 Hard Disk Window 

Quick Operating Instructions for Hard Disk Volume Will not Mount 

A) Click Setup, dialog boxes will prompt you. 

B) CHck on Check Hard Disk. 

C) The disk will be checked. The driver number and drive number used are 

printed in the middle of the window. 

D) If there are any problems a message will be printed in prompt box. 

E) Click on Fix Messages to fix these messages. 

F) Attempt to mount the volume using your mount manager. 

If it mounts then back up what you need. It is your choice as to whether to 
initialize after you backup. If it is a Hyperdrive it is probably OK not to. 

G) If the volume does not mount then use Extract File (Next). 

Quick Operating Instructions for Extract a file from a Volume 

A) Click Setup, dialog boxes will prompt you. 

B) Set the file name that you want to extract by clicking on Current File Name. 

C) Set the destination volume to move the file to by clicking on Destination 
Volume. 

D) Click on Extract File WAIT....WAIT..be patient! 

Loop to B for each file that you want to extract. 

Hard Disk Recover Window 

The hard disk window in the Mac Zap Recover program will help you 
recover crashed volumes on an MFS hard disk. It can also extract files from an 
MFS hard disk that has totally crashed and Zap Recover cannot revive. 
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Note: These utilities can also be used on MFS Floppy Disks, use the Sony driver, 
drive number is 1 (internal) or 2 (external). These utilities do not use the file tag 
system that the floppy disk window depend on. The directory and allocation 
block table are used. 



Hard Disk/File Recouery 



Setup 



Check Hard Disk 



Messages [ l-iK M«^s<ki«^ 1 ( Help 



O Hyper Driue 
O Lisa/Mac KL 
® Other Hard Driue 



Driuer Number: 0 Driue Number: 0 Uolume: No Uolume Set 



File EKtraction 



Current File Name 



Destination Uolume 



No File Entered 



Peak 65 



[ EKtract File 



Setup 

The Recover program needs to know where the bad disk or volume is 
located. This button will bring up two dialog boxes that prompt you for the 
Driver and the Drive Number to use. The first dialog box lists all of the drivers 
currently in memory, you select which one to use. Hard disk companies will 
usually have a driver name that is recognizable, i.e. their company name is part 
of it. Other companies might just use a name like '.HDdriver'. There is no 
standard unfortunately. 



After the driver number has been selected the next dialog box prompts you 
for a drive number. The recover program will try to look for all possible drive 
numbers and the volume names associated with each. Enter the Drive number to 
use. 
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Check Hard Disk 

When this is clicked on, the Recover program will take the driver and drive 
number and check the volume at that location. The allocation blocks (2-??) are 
read in and checked for accuracy, volumes up to 15Meg (4k alloc) can be 
checked. Any problems are listed in the prompt window. There are two 
algorithms used in correcting allocation table problems. These can be selected in 
the parameter pull down menu. They are described more fully in the menu bar 
section. If there is a problem detected the Fix Messages button will be enabled. 

Fix Messages 

This button is clicked on if you want Mac Zap to repair any problems found 
by the 'Check Hard Disk'. 

Current File Name 

The name used by Extract File. This is the file that will be moved off of the 
crashed volume. 

Destination Volume 

This is where the extracted file will be moved to, 

ExtractFile 

This option can be used to extract programs from a crashed volume that 
cannot be recovered by other Mac Zap Recover. Before using this button set the 
'Current File Name' and 'Destination Volume'. 

This button will extract the 'Current File Name' to the 'Destination 
Volume' 

3.2.3 Menu Bar Options 

Parameters 

This pull down menu has two selections that are used in hard disk or other 
disk recovery, they are described below. 

Algorithm 1 

This algorithm fixes the allocation table by writing zeroes after NumUsed 
allocation blocks have been found starting at the beginning of the allocation 
table. (Number Allocation blocks)-(Number of Free Blocks)= Num Used 

Algorithm 2 

This algorithm fixes the allocation table by making the table calculated free 
blocks agree with the entry free at 34 bytes into the volume blocks. 
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33 Mac Zap Recover HFS 



Quick Operating Instructions immediately follow this paragraph. For 
more detailed instructions on all of the features of Mac Zap Recover HFS see 
section 3.3.1. There are two windows in Zap Recover HFS. The first window 
is the Quick Recover window that is visible when the program is run. The 
other window is the Recover Window that can be opened under the 'File' pull 
down menu. 

Quick Operating Instructions for Quick Recover Window 

Dialog boxes will lead you through all of the Setup Procedures. 

A) Run Zap Recover 

B) Zap Recover will recover the files from your damaged disk and move them to another 
location, either floppy disks or another volume. In the bottom of the Quick Recover Window 
are two radio buttons. They are used to select where to store the recovered files, on floppy 
disks or a destination volume. If you select the destination volume you can use the 
Destination Volume button to point at the volume to store the recovered files on. 

C) Click Recover Files in the Quick Recover Window 

Select Device the files are on. 
If Roppy 

Select Internal/External and Single/Double Sided. 
If Hard Disk 

Select the Driver to use and then the Drive. 
If SCSI 

Select Drive to work with. 
If Volume File (MacServe etc..) 

Select the File to work with. The network volume 

is stored as a file, we need to know which one. 

D) Zap Recover will now scan the disk and look for the files**. When finished Recover will 
tell you how many files and folders were found and ask for confirmation to save the files 
onto Floppies or the Destination Volume (whichever you selected in B above). If you 
confirm then Recover will finish the operation by moving the files. 

**Volume INFO Block is Trashed 

If you get a dialog box with this error message then Mac Zap needs a parameter file for your disk drive. 
Mac Zap will use a file select dialog for you too load the parameter file automatically. There are parameter 
files on the Zap Disk that you received. Select a parameter file that is named for your disk drive. Example 
Dataframe 20' or 'Peak 20*. Once the parameter file is loaded Zap Recover will scan the disk again and 
continue. If there is no parameter file for your disk drive see page 45. 

NOTE: 

The recovered files are stored in a folder, named AJlecover, on the destination drive. If a folder 
AJlecover is present then Bilecover etc... is created. 
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Quick Operating Instructions for Recover Window 

Dialog boxes will lead you through all of the Setup Procedures. 

A) Run Recover 

B) Open Recover Window 

C) Click Setup in the Recover Window 

Select Device the files are on. 
If Floppy 

Select Internal/External and Single/Double Sided. 

If Hard Disk 

Select the Driver to use and then the Drive. 
If SCSI 

Select Drive to work with. 
If Volume File (MacServe etc..) 

Select the File to work with. The network volume 

is stored as a file, we need to know which one, 

D) CHck Scan Disk (If you get a message "NO VOL INFO BLOCK* see below**) 

E) CHck Dest Volume , point to the volume the recovered file should be stored on. 

F) Select File (in File list on Screen) to Recover, Click Recover File 

Loop to F: for all of the files you want to recover. 
Alternatively 

Click on Evervfile Menu Bar to recover all files in Ust 

With this choice you can save all of the files to the 
Destination Volume or save all of the files to Floppy disks. 



**No Vol Info Block Case. 

If you get this error message when you press Scan Disk you need to load a parameter file for your disk 
drive. Use the l-oad Parameter File' option under the Expert pull down menu. Select a parameter file that is 
named for your disk drive. Example Datafirame 20' or Peak 20*. Once the parameter file is loaded click on 
Scan disk and the program will continue. If there is no parameter file for your disk drive see page 45. 

NOTE: 

The recovered files are stored in a folder, named AJRecover, on the destination drive. If a folder 
AHecovei is present then B Jlecover etc... is created. 
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3.3.1 Recover Window 
Shown below is the Recover Window that is opened when you run 
Recover HFS. 



Mac Zap Recouer HFS U4.5 



Mac Zap HFS Recouer U4.5 Messages [ Recouer Info ] [ Help ] 



Setup ] ^ S( tm Disk j ^^^^ 



Uolune: Mo Uolume Name 



No Name 



TypezflPPL Creator:???? 

ileNum OK Size Res His Pat tils Type Date Name 



O 



J^7a!r m'JJ be listed l^re after Scan 



Destination Uolume / Free Kbytes ) Untitled / 51542 



When you first run Recover the only buttons that are enabled are the Help . 
Setup, and Destination Volume buttons. They are: 

Help 

Self Explanatory 

Destination Volume /Free Kbytes 

Recover will move files off of the damaged hard disk and store them onto 
the volume selected by this control button. When you click on this button 
Recover will cycle through all of the mounted HFS volumes that you can store 
recovered files to. The free space on that volume is printed immediately after 
the volume name. 

NOTE: The destination volume must be an HFS volume. 
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Setup 

This button is used to 'Setup' the recovery process. The recover program 
needs to know where the damaged Volume with the files you want is located. 
There are four options, Floppy disks, Hard Disk Drives, SCSI Hard disk and 
the last is a Volume File. 

SCSI Disks are hard disk drives attached through the SCSI port on the 
Mac Plus or Enhanced 512k Mac. 

Volume Files are volumes stored as a file on another volume such as a 
hard disk. These volume files are used by programs such as MacServe, a 
Network Server, and programs that partition hard disks. 



Select Deuice For 
Recouery Operation 

O Floppy Disk 
O Hard Disk Driue 
OSCSI Disk 

O Uolume File (Mac Serue & others) 

/ N 

Cancel 

V / 



Floppy Disk 

If Floppy disk is selected you will be asked for internal or external disk 
and if the disk is single or double sided. 

The Scan Disk Button, described later, is then enabled. 

Hard Disk Drive 

If Hard Disk is pressed you will be asked to select a hard disk driver, from 
a list presented to you. For example the Hyperdrive uses a Driver called 
HDdriver. These could be any name possible but companies usually select a 
recognizable name. 

The Scan Disk Button, described later, is then enabled. 

NOTE: SCSI disk users should use the SCSI device option and not this 
Hard Disk Drive option. 
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SCSIDisk 

If SCSI is pressed the recover program will scan the SCSI bus and find all 
mac hard disk drives that are powered up on the SCSI bus. There are 8 possible 
hard disk drives on a single Mac. When all of the hard disks are found a dialog 
(Shown below) is used to select which hard disk to recover files from. When 
one of the hard disks is selected the recover program will read some volume 
information off of the hard disk. 

The Scan Disk Button, described later, is then enabled. 



Select a SCSI Deuice to work on. 


O PLUS-20 




O n<n»l< i> { 


O nei»i< ^> 5 


O n<uM( j> z 








Cancel 


4 



Volume File 

If Volume File is selected during Setup the user is prompted for the file to 
use as a logical volume. The Dialog box below appears. A user would click on 
'Select File Volume' and a standard file selection dialog box appears. After 
selecting one of the files the recover program prints the file name next to 
Volume File: and the name of the logical volume next to Volume Name: 

The Scan Disk Button, described later, is then enabled. 

Example : 

In the case below a MacServe Volume has been selected, the file on the 
hard disk is called MS Vol-3089 and the logical volume in the file is Pserver. 
How do you know which file on a hard disk is the Volume File?? The 
originating company, such as Infosphere which makes MacServe, can tell you 
the name of the Volume files. 
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Uolumes stored as Files for Partitioning or LAN's 



Select File Uolume 



UolumeFile: MS UoH3089 
Uolume Name : Pseruer 



Uolume starts on Block 



of File. 



OK 



Cancel 



SCANDISK 

NOTE: Expert users can edit and alter the setup information that the 
recover program has at this point. See the EXPERT section at the end. 

Pressing this button will tell the program to scan the damaged volume and 
find all of the file information that it can. A list of all of the files is displayed 
for the user after the scan. Along with the file name is other information: 



Filenum 


File number (used by operating system) 


OK 


Is the file intact to the best of our analysis?? Yes or No 


Size 


Size of the file in Kilobytes 


Res 


Size of the resource fork in Kilobytes 


Mis 


Missing data of the resource fork in Kilobytes 


Dat 


Size of the Data fork in Kilobytes 


Mis 


Missing data of the data fork in Kilobytes 


Type 


File Type (Creator can be seen by clicking of this file entry) 


Date 


Last Modification date for this file 


Name 


FileName 



At this point the user selects a file, out of the displayed file list, and then 
clicks Recover File . The file is then moved to the destination volume. 

This can be done repetitively for all of the files you wish to recover. You 
do not need to do setup or scan between each file recovered. See the everyfile 
menu option to recover all files on a volume. 

NOTE: If you get a message 'No Volume Info Block' when you press Scan Disk you need to 
load a parameter file for your disk drive. If there is no parameter file for your disk drive see 
the discussion at the end of this section, page 45. 
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3.3.2 Menu Bar Options 

Type and Creator 

Set the type and creator or use the Scan Values. We recommend you leave 
this set to Scan Value. 

Expert 

Gives the user access to recover parameters (see the Expert section at the 
end of this section). 

Special 

Sort Files in List 

Sort the Files in the list alphabetically. 

Find File in List 

Enter a file name and the file list will be searched for this file. If present the file list will 
be moved to start with this file. 

Filter Scan by Type 

If checked, the user will be prompted for a Type to filter the file list by. Only files of 
this type will be added to the file list when the disk is scanned. 
Example: 

To recover all Microsoft Word files use a type of WORD for filter. 

First Block, Second Block, Third block 

This will allow recovery on very large disks that have over 3000 files on. With these 
the user can select the 1st 2nd or 3rd block of 3000 files to recover. 

Single Recover 

Specify a single file, the disk is then scanned for this file only. This is put in because of 
limitations on memory and structures. Very large Very fragmented files may need to be 
recovered using this procedure. 

Kill Desktop 

The recover program will go out to the damaged disk and remove the desktop file. This 
will sometimes allow the damaged volume to mount 

Kill SCSI Driver 

The recover program will kill the driver on a SCSI Disk. In some cases a damaged 
SCSI drive will repeatedly try to boot, this interferes with the recovery process. By killing 
the driver on disk and rebooting, the SCSI driver should stop this repetitive boot process. 
CAUTION; Only for sick Disk drives. 

Load Parameters 

This option will load a parameter fUe that contains the values for the 'SCSI Parameters' 
and 'Recover Parameters' dialog boxes. 
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Everyfile 

This is used to recover all files that are in the file list. There are two 
options for recovering all files. 

The first option will store all of the files on the destination volume. The 
destination volume must have room for all of the files to be moved to. 

The second option will store all of the files on floppy disks. The user will 
be prompted for blank disks to store the files onto. This is only available if 
your internal disk drive is a double sided drive. 

NOTE: by using Filter by type the user can reduce the file list to only those 
files that he wants, for instance WORD files, Spreadsheet files (XLBN) etc. 



Expert Dialogs 



A knowledge of SCSI devices and disk structures is assumed in this 
section. This section and the dialogs described are NOT needed in the normal 
operation of the program. These dialogs set parameters needed in worst case 
crashes. Users can skip these dialogs and load a parameter file made by Micro 
Analyst for their particular disk drive, use the Load Parameters option under 
the Expert pull down menu. 

The Expert pull down menu gives the user access to some recover 
program parameters. Once a device, disk or volume file, has been selected the 
recover program will look for some information such as allocation block size 
and other values. 

The dialog box below is used to select which SCSI device to use, and 
define where the Mac partition boundaries are. 



0 



EKpert Ouerride Option SCSI Set Parameters 

SCSI Deuice Number: 
First Blocic of Uolume (Decimal): 
Number of Blocks in Uolume (Decimal): 



16 



44048 



The next dialog box is used to set the recover parameters. When a disk has 
bee selected by Setup the Volume Information block is read and the recover 
parameters are setup. If there is no volume information block or the user 
wants to override he can use this dialog box to set the parameters. 
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If there is no Volume information block and no parameterf file for your 
disk drive then Zap Recover has no idea how large the volume is and other 
important information is missing. We need some guidance to scan the disk. Use 
the 'Recover Parameters' option under the Expert pull down menu to guide 
Zap Recover, this will show the dialog below. 



EKpert Ouerride Option Set Recouer Parameters 

® Default EKhaustiue Directory Search 
O User Limited Directory Search^ 
First DIock of Search: 



Number of DIocics Forujard: 



® Default EKhaustiue File EKtent Search 
O User Limited File E»tent Search 

First Block of Search: 



Number of Blocks Forward: 



0 



Allocation 
Block Size: 



512 



First Block 
in Bit Map: 



OK 



14 



[ 



Cancel 



There are 4 things to set, two search areas and two parameters. 
Search Areas 

The user needs to set limited search areas for the directory and file extent 
data areas on disk. As a last resort gesture the user could set the entire disk as 
the search area. For Example: 

Click on 'User Limited Search' for both File and Directory. Set : 
Start block=0 

Number blocks Forward = (Disk size in bytes)/512 

Example 22 meg disk 22,000,000/512 = 42,969 blocks forward 

Two Parameters: Allocation Block Size and First Block in Bit Map 

Both of these parameters can be acquired by running Zap Recover on a 
good disk and clicking Setup. Then open this dialog and read off the current 
values. These are the values for a healthy disk drive. We are trying to build a 
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database of values....we would appreciate any contributions, via the BBS or by 
mail. These two values can change from drive to drive and there is no 
standard. Different drive manufacturers can use different values, there are 
guidelines but that doesn't mean they are followed. 
Allocation Block Size 

Allocation Block Size needs to be set. For disk sizes of 20 megs or below 
set 512. For larger drives set 1024 (30-40 megs) or 1536 (50+megs). 
First Block in Bit Map 

This value can vary depending on the disk size. We suggest trying 14 but 
again there is no standard. 

One other source of information for these two parameters is the duplicate 
copy of the volume information block at the end of the disk. This duplicate 
copy is not always present but usually is. This block is a copy of the volume 
information block and is at the end of the disk storage. 

The other menu options under the Expert pull down menu bring up the 
different dialog boxes that request user input. They can be called in any order 
but the Recover program needs the following data before it can do a Scan disk 
with default search patterns. 

If SCSI 

SCSI ID and First block in Volume 
Allocation Block Size 
Pirst block in Bit Map 

INITIALIZED HARD DISKS 

Mac Zap Recover can even recover files from a hard disk that was 
mistakenly initialized. (Note: Recover cannot help on Formatted hard drives) 

Not all files will be recoverable because some of the information is lost 
when the disk directory is initialized. To recover any files left you can: 

Run Recover 

Open Recover Window (NOT the Quick Recover window) 
Click Setup and point to the initialized disk. 

Under the Expert pull down menu select 'Load Parameter File' and load 

the parameter file for your disk drive. 
Click Scan Disk, all files left will be displayed to you when the scan is done. 
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HFS 



NOTES: 



Times Foot Used 4/1S/87 



Volnme Moonts 
and Files Present 



Mount the volume after 
you are in MacWrite, Word 
or other ^plication. Try 
to load file and save to 
good Volume. 



Volume Grashed 



Volume Mounts 
and Files Present 



When you Mount the 
Volume hold down the 
Conunand and Option Keys. 



No 











^ Have your done: ^ 
Things To Try First? 1 



1) A volume is a Floppy Disk. Hard Disk 
SCSI disk etc... 

2) Running Recover HFS Setup on a good 
Volume WILL not harm it. We only read 
Data from the volume. There are no disk 
Writes. This is true for the recover process 
also. Our program will not make mattets 
any worse!! (unlike other programs that mil!) 

3) If your disk was initialized by mistake, either 
by you or another program then load a parameter 
fue for your disk before you 'Scan Disk'. 

4) See "* in middle left of page. 
If you do not have a parameter file 
for your disk drive you can Read the 
Mbc Zap manual section on Expert 
pull down menu and try to derive or 
obtain your own parametets. The other 
<qition IS to call Micro Analyst or I 
onto the Bulletin Board and see if tlTere 
are ai^ new parameters for your drive. 

6.9 

Quit 



Number of Files & Folders found 
is printed. The Recover program 
asks for a final confirmation before 
storing all of the recovered programs 
to Floppies or Destination Volume, 
depending on what you selected in 
the beginning. 




1) Run Recover HFS 

2) Close Quick Window. 

3) Open Recover Window. 

4) Click Setup and point to bad drive. 

5) Open 'SCSI Parameters' (if SCSI) and set values. 
Opea 'Recover Parameters' and sec values. 
Don't forget to set the 'User Limited Search areas' 

See Zap Manual for suggested search areas. 



10) MacServe stores volumes as large 
uofragmented files on a hard dhk. drive, 
we call these Volume Files. All MacServe 
Volume Files begin with MS-Vol ####. 
Other programs partition a hard drive by 
creating ^ume files also. 
Selea a file and Recover will try to find 
the volume structure and name u the file 
coments. 




Volume info Block or 
a parameter file describes 
where to look for Directory 
Information. A data struaure 
of all Directory file entries is 
built in memory. 



^ScanDone 



Quick 
Window 



Quick Window 

or Recover Window? 



- ^ Tell User how 
^ many files/foldets 
found and ask 
for confirm to 
recover Files. 



If No Volume Info Block and 
Parameters not set then exit 
with a Warning No Vol Info. 



Display Rles or Folder f . \j 
list depending on how ""H 
coioru is set m Recover 
Window. 



S) The driver name will usually be recognizable. For instance 
Hyperdrive is .HDdriver, Bemouli has Iomega in it and Peak 
^tems is .Peak. 

€) Datafcame users onlv. Dataframe's initializer prqgtram will not 
set the first block in vuume to the same value every time. This 
value can be 17, 34 or SI. The most common is 1/ but we have 
seen others. If you recover applications and get an ID 26 when 
you run them use a different ^^ue. 

7) Bemouli users only. Put the bad bemouli cartridge in Che top 
drive. Initialize or use a good cartridge in the bottom drive. You 
must be using V4.S4 or teter for Bemouli Recovery. 



S) SCSI users ONLY. We recommend that when you are in 
Setup that you select SCSI device and try to recover your flies. 
If you are unable to recover files via this method then selea 
lurd Disk Drive and select a driver for your hard disk, see S 
above. When you selea Hard Disk Drive the SCSI panunecers 
are not used because we are accessing the SCSI through the 
drive manufacturers driver. The Value 'First Block in volume' 
is no longer important and is not used. 



ID 26 Error or File Errors 

9) If you get an ID 26 when you open a recovered i4>plication or 
your data files are scrambled/refuse to open then the data may 
be shifted. If the volume info block data or the parameter data 
that was used is not. valid then you will still recover files but 
the data in Che files will be shifted and the file or application 
is scrambled. The most common poblem for this is the first 
block in volume value (SCSI devices only). Other possible 
problems are inconrea values fcx' Allocation block size or 
first block in bit map. 
Dataframe users see note 6 above. 



He. a. 
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PftTCH 



4.0 Mac Zap Patcher 



This program is used to remove protection from programs so that 
backup copies can be made. Some programs can then be moved to a hard 
disk for execution without the need of master key disks. Not all programs 
can be executed off of a hard disk (due to memory requirements or system 
assumptions by developers) once their protection has been removed, but 
many can. 

To use this program you should first make a block copy of your 
original master disk using Mac Zap Copy. This copy will then be patched by 
Mac Zap Patcher. 

See also Appendix A on moving protected programs to a Hard Disk. 

Quick Operating Instructions 

A) Make a Mac Zap Block Copy of the disk you want to patch. 

B) Run Mac Zap Patcher 

C) Click on Select Patch File, select the patch file you want to use. 

D) Insert the block copy (made in A above) when prompted. 

E) Click Continue. When the patch is installed, your disk will eject. 

F) Drag over application and it's files (some may be invisible) to the hard 
disk. 

4.1 Patcher Window 



c 



Select Patch File 



fl> Select Patch File With Button Above. 
B) Vou will be prompted for all actions, 

No Patch File Loaded 



Prompt Box 



Continue 



Cance I 



Destination Uolume J My Hard Disk Volume 
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Select Patch FUe 

A standard File Selection dialog box will appear and you select a 
filename, such as Multiplan. Once you select a patch file, prompts will 
appear in the prompt box of the patcher window. You have two options at 
this point, one is to click Continue after the prompts, the other is to click 
Cancel and stop all action. The prompts will tell you what to do. 

For example.-Think Tank 512 

The Think Tank patch file will remove the protection from a disk you 
insert containing Think Tank (the disk you insert should be a copy of your 
original Think Tank disk). Once the patch has been made just drag Think 
Tank 512 over to the hard disk. NOTE: Some applications have data files on 
the disk that need to be present when they run, also some of the data files 
may be invisible. Mac Zap Tools can be used to show invisible files. 

Cotitinue 

The patch file will stop at some places and prompt you. For example 
the patch file might request that a disk be inserted. Once the disk has been 
inserted click continue to proceed with the patch. 

Cancel 

This will terminate the patch operation. 

Destination Volume 

Some of the patch files will move files from a floppy disk to a hard 
disk volume automatically. Destination Volume selects which volume these 
files will be moved to. Clicking on the control button will cause it to cycle 
through all of the mounted disk volumes. 

Advanced users can make their own patch files if they have a patch for 
a disk. See the Mac Write Document 'Patcher types' on the Mac Zap Disk in 
the Patches Folder, 

To generate a patch for a disk requires a knowledge of Assembly 
language. Inside Macintosh and some experience with Mac Programming. 
Our book on 'Software Protection' describes how software protection is 
implemented and removed. 

NOTE: There are several pull down menus and controls not 
documented. The Patcher program resides inside an older version of the 
Mac Zap Tools. The new tools supersede these controls and menus. They 
are left in for historical detail. 
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COPY 



5.0 Mac Zap Copy 



Mac Zap Copy can backup protected software disks. 
NOTE: Mac Zap Patcher Can make Backup Copies Also!!! 

Quick Operating Instructions for Block Copy Mode 

A) Run Mac Zap Copy 

B) If Double Sided Disk then click Double Sided Disk 

C) Click Start 

Mac Zap will prompt you for the source disk in the internal disk drive. 
Mac Zap will prompt you for the destination disk in the external disk 
drive. 

When the copy is done both disks will eject. 
Quick Operating Instructions for Track Copy Mode 

A) Run Mac Zap Copy 

B) Click Track Copy 

B) If Double Sided Disk then click Double Sided Disk 

C) Click Start 

Mac Zap will prompt you for the source disk in the internal disk drive. 
Mac Zap will prompt you for the destination disk in the external disk 
drive. 

When the copy is done both disks will eject. 

5.1 Disk Copy Window 

Mac Zap Copy is used to make backup copies of protected (and 
unprotected) disks. This copy is a 'xerox' of the original disk and still 
contains the protection system intact. 

To make a copy the user would first select the Copy Mode, either 
Block Copy or Track Copy, by clicking on those controls. We recommend 
trying Block Copy first as it will copy a lot of the software and makes a 
good copy. If you cannot make a good copy then use Track Copy mode on 
those tracks that give errors (in Block mode an error message will tell you 
what track errors are on), or over the entire disk. 
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Disk Copy UJindouj 



Track Copy 



Select 
Copy Mode 



Block Copy 



( Start Track 1 qq 
® - O 



Start Copy 



79 [ End Track ) 

(•) Internal 



Source Disk 



O Externa I 

e ^ O Internal 
Cancel Copy Destination Disk ^ 
' (i) Externa I 



(§) Init Destination 
O Synchron i ze Tracks 
Ostop on Track Err 
OUse Speed Bi as 

O Doub 1 e S I ded D i sk 



00 

Track Copy Speed Bias 



Track Resu I ts 

00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 
00 I I I I I I I I I I I I I I I I I I I I 
20 
40 

60 ^ ^ 



Start Track 

Select the starting track (displayed to the right of the control). A dialog 
box will ask you for the starting track (enter a decimal 0-79). It is used to 
tell Track Copy Mode which track to start copying on. 

A and B beneath Start Track 

This tells Mac Zap which side of the Start Track to start copying 
(Double sided disks only). 

EndTrack 

Similiar to Start track. The current value is to the left of the control. 

A and B beneath End Track 

This tells Mac Zap which side of the End Track to quit copying 
(Double sided disks only). 

Track Copy 

Clicking on this control will make the disk copy mode use a Track 
Copy system. We recommend trying a Block Copy first as it is more 
reliable. If that does not work then copy any tracks with errors or copy the 
whole disk with the Track Copy mode. 
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Block Copy 

Clicking on this control will make the disk copy mode use a Block 
Copy system. This system can copy many of the protection systems used and 
produces a very reliable disk. 

Source Internal Source External 

Clicking on these radio button controls will decide where the source 
disk is read from. 

Destination Internal Destination External 

Similiar to the previous control, this decides where the destination (or 
Duplicate) disk is written to. 

Start Copy 

This will start the copy process. If you are using a single disk drive the 
number of swaps is printed in the window. You will be prompted for all 
disk insertions. Any errors or protection detected will be documented in the 
data window. 

Cancel Copy 

Click on this control to stop the copy process once it starts. 
Init Destination 

In Block Copy mode this decides if the destination disk is initialized. 

Synchronize Tracks 

If set this tells the Mac Zap Copy program to copy the tracks in a 
synchronized manner. Few protection systems use this method. This 
control only matters if you are using Track Copy mode. 

Stop on Track Error 

If set Mac Zap Copy will stop the copying process when it detects an 
error. The possible errors are listed below. 

Use Speed Bias 

If set the speed bias is used in reading and writing a track to the disk 
during copy. This is only valid if you are using Track Copy. 

Double Sided Disk 

This control tells Mac Zap whether to copy single or double sided. 
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speed Bias Scroll Bar 

This control gives you the ability to set a +-400 bias to the speed of the 
Sony disk drive. The Sony disk drive has a 400 step speed control. The 
current bias is printed beneath the scroll bar. It is used only if Use Speed 
Bias is set 

Mac Zap Copy Error Codes 

When using Mac Copy the track map will show error messages if it has 
trouble copying a block or a track. If a space or a dot is displayed then there 
is no error code for that track. An error code will be a two digit number as 
described next. 

If number > $80 then it is a system error returned by operating system 
example: AF Sector not found B9 No data marker found 
If number <$80 then it is a Mac Zap error codes as described below. Also if 
the control 'Stop on Trk Error' is set (Button is on) Mac zap will stop on 
those errors below with stop printed next to them. 

First Character 
Ox No error 

Ix Length of Track Wrong 
2x Number of Sectors Wrong 
4x No Data Marker Trailer 

Second character 

xO no error 

xl Find Length using d5aa96 

x2 Find Length from user Address Marker 

x3 Find Length using DEAA trail 

x4 Set Track Length by Pattern Matching 

x6 Set Track Length Manually 

example: 

23 2=number of sectors wrong 
3=find length using DEAA trail 

The track map at the bottom of the Disk Copy window has a box for 
each of the 80 tracks (0-79) that can be copied. 

These error codes are feedback on any disk protection Mac Zap encounters. 
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Main Window Controls 

Sector Address 

This routine will take the 5 bytes at the edit cursor (black box) in the 
main window and decode them for a track and sector address. An address 
marker is followed by 5 bytes and then a DE AA. The 5 bytes are the track 
and sector address of the block and a checksum. The following example is 
for Block 1 on track 0: D5 AA 96 96 9F 96 9A 9D DE AA 

Track Start 

This control has a value printed next to it that is the start of a track 
image in memory for the track just read into memory using the Track pull 
down menu. A user can manually set a track start by setting the edit cursor 
(black box) on the byte to begin the track and clicking on the Track Start 
control. 

TrackEnd 

This control is similiar to Track Start described above. 

Track Length 

This is the length of (Track End - Track Start). 



5.2 Menu Bar Options 

Track 

This menu allows the user low level track access with analysis and 
information display. 

Read Track (No Analysis) 

This option will read in a track (first using a dialog box to ask the track 
number) and then set the main display window to the track buffer. No 
analysis or track modification is done except for finding a track start, track 
end, and track length. 

Read Track (Analysis and Modified) 

This option will read in a track, set track start, track end, track length 
and give an analysis of the address and data markers used, spacing and any 
detectable anomalies. The track image in memory is modified to ready it 
for writing as if the copy program was doing multiple track read, analysis 
and track write. 
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Read Track (Timing Information) 

The current option will read in a track and obtain timing information 
on the data as it is read in. Sync bytes will be marked with the high bit being 
0. This is for advanced users who are familiar with track formatting etc. 

Write Track 

Write the Track back to disk, use Track start and track length. If the 
Use Speed Bias control is set the speed bias will be used for tiiis write 
operation also. 

Double Sided Disks 

For double sided disk drives tiiere are two options in the pull down 
menu to select Side A or Side B to read/write a track. The current side 
being used is checkmarked. 



Markers 

This pull down menu can change the data and address markers used by 
the system for reading and writing floppy disk blocks. 

Data Marker 

Two options are available, one uses a dialog box to obtain a new data 
marker entered by the user. This marker will then be used by the operating 
system when reading or writing blocks. 

The other option will reset the data marker to the standard operating 
system marker of $D5AAAD. 

Address Marker 

Two options are available, one uses a dialog box to obtain a new 
address marker entered by the user. This marker will then be used by the 
operating system when reading or writing blocks. 

The other option will reset the address marker to the standard 
operating system marker of $D5AA96. 



Note: The disk window has controls to read and write blocks to a disk. The 
block is displayed in the Main window and can be edited before writing 
back out. 
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6.0 Fast Disk Copy 



Using this program a user can copy unprotected software disks or 
files.This program is compatible with MFS or HFS and single or double 
sided disks. When the program is run the following window will open on 
your macintosh. 

Quick Operating Instructions for Copy Disk 

A) Run Fast Disk Copy 

B) Click on 'Read Disk into Memory' 

C) Insert Disk into the Internal Disk Drive. 

Disk will be read into memory and ejected. 
Disk Type and size etc will be printed. 

D) If you want the destination disk formatted before copying then 

click on 'Format before Copy' 

E) Insert the destination disk into the internal disk drive. 

Click on 'Copy Memory to Disk'. 
Loop to E for as many copies you want. 

Quick Operating Instructions for Copy Files 

A) Run Fast Disk Copy 

B) Click on 'Only Files Copied' 

Default is all files, if you want only certain types then click on 
'Files Copied of Type', you will be prompted for what type. 
Also Default is that files with same name will not be overwritten 
on the destination disk. If you want them overwritten set true. 

C) Click on 'Read Disk into Memory'. 

D) Insert Disk into the Internal Disk Drive. 

Files on disk will be read into memory and disk ejected. 
Number of files and size is printed. 

E) Insert a disk into the internal drive. NOTE: Must be formatted. 

Click on 'Copy Memory to Disk'. 

Loop to D for each disk that you want the files on. 
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Shown below is the Fast Disk Copy window. 



Fast Disk Copy U1.1 



g^FDC 
'3 



Copy Mode 



O Euery Sector Copied 
® Used Sectors Copied 
O Only Files Copied 



Driue Used 
O Format Before Copyiny 



flPPL 



Read Disic into Memory 



Current Disk in Memory 
Nothiny 



Data Storaye « 0768 KBytes 



Copyriyhtl986 "^^iyJlV fH;:^ 

(512) 926 4527 ^" ^ 

flustm Tk 78761 



Below the Copy Memory to Disk button is the size of buffer that was 
allocated for copying. The buffer size will vary with the amount of 
memory available. NOTE: To obtain the most memory possible you can 
boot disks without macsbug or unneeded device drivers and then run Fast 
Disk Copy. 

There are 3 copy modes available: 

Every Sector Copied 

This mode will copy every sector on a disk. If there is not enough 
buffer space to copy the inserted disk it will be ejected and a message telling 
you this is printed. 

Used Sectors Copied 

This mode will copy every sector on a disk that is being used. Those 
sectors that are free or unused are not copied. This is a faster copying 
method that also uses less buffer space. The source disk will be duplicated 
onto the destination disk. 
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Only Files Copied 

This mode will copy the files on a disk, not the sectors. There are three 
options with this copy mode. 

1) All Files Copied 

2) Files Copied of Type - XXXX 

You can select one of the two selections above to decide which 
files are copied. If the first is selected all of the files (Except the desktop) 
are copied to the destination disk. If you select the second then you are 
prompted for a 4 byte TYPE to enter. All files of that TYPE are then 
copied to the destination disk. The default setting is APPL which is for 
Applications. File info in Mac Zap Tools can tell you the TYPE for any file. 

3) Replace Files on Destination Disk 

If this option is selected in File Copy mode then a file with the 
same name will replace a file on the destination disk. Otherwise files with 
the same name will not be overwritten. 

On the right side of the window are the buttons that decide which disk 
drive is to be used and a button that selects whether the destination disk is 
formatted before being written to. 

Copy Disk to Memory 

Using the Copy mode, described above, copy the disk or files into 
memory. 

Copy Memory to Disk 

Using the Copy mode, described above, copy what is in memory to the 

disk. 
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7.0 Bulletin Board Support 



There is a bulletin board that users can log onto for patch file 
downloads and support of other Mac Zap areas. Some of the sections are: 

Disk and file recovery. Developers/Programmers Section. 

Patch file Downloads (150+) Public Domain Program downloads. 

There is a 512k Mac with 20 Meg hard disk and a 300/1200 baud 
modem attached. 

Owners of Mac Zap can access this bulletin board by calling the number: 
(512) 926 9582 The LifeBoat 

To be validated on this board you need to send in the following: 

Registration Fee 

$15 for six montiis validation 
or 

$25 for 12 months validation 
Name address 
Phone number 
Mac Zap serial Number 

The Mac Zap serial number can be found in the About Mac Zap dialog 
box under the Apple pull down menu in Mac Zap Tools or Copy. 

Send the above to: 

Mac Zap Bulletin Board 
P.O. Box 15003 
Austin Tx 78761 

or Call: (512) 926 4527 (Voice) Visa/Mastercard Accepted 

Contact us with the above information and then using the same name 
log onto the bulletin board. Once we have your registration notice and fee 
we will look on the board for a user with that name and validate him. Until 
you are validated you will have limited access to the sections on the bulletin 
board. Allow 2 weeks from mailing the registration until you are validated. 
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Appendix A Moving Programs to Hard Disk 



The patcher program will remove the protection from programs so that 
they can be copied for backups. Some of these programs can then be put onto a 
hard disk or ram disk for faster operation. Unfortunately not all of the 
programs can be moved to hard disk. The reasons why they cannot are usually 
due to memory considerations or assumptions made by the original programmer 
that do not allow execution off of a hard disk. See section 4.0 for using patcher 
program. Two other techniques for executing programs off of a hard disk 
without the master floppy being present are described next. 

1) Some programs reference a file that needs to be moved onto the hard disk 
for the main program to work. Look for these files and move them to your hard 
disk drive volume. For example help files or invisible data files. A patch file will 
remove the protection so that the special files do not have to be moved to the 
hard disk. Tliis documentation is for some programs that do not have patches. 
To move invisible files to a hard disk: 

Boot Mac Zap Tools, insert a copy of the application being moved to hard disk. 
Use File pull down menu and get a list of files on that disk. Use volume file list. 
Make any invisible I or protected P files Visible and Unprotected. 

Use File Info Window. 
Quit from Mac Zap Tools and drag these files to the hard disk. 
Boot Mac Zap Tools and make these files Invisible and Protected again. 

Some of the Programs that use this technique are: 

MSOFT Multiplan Needs Neil Konzen 

MSOFT Chart Needs Ed&Mike on Hard Drive 

Hayden Speller Pinot Mac 

Factfinder Bryan and Rudy 

2) Some programs have a hard disk install program such that they can be 
installed to a hard disk a Umited number of times. Using the following steps you 
can install some of these programs to hard disk repeatedly. 

A) Make a block copy of the original disk. We will call this 

disk B and the original will be called disk A.Write protect disk A. 

B) Boot disk A and do a hard disk install. When the disk A is 
ejected and they ask you to Un-Writeprotect the disk insert 
disk B. The counter (number of times installed) will then be 
decremented on disk B which is a block copy of the original 
which you can make over an over. 
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Appendix B 

Boot Blocks 



The first two blocks on every volume are called the Boot Blocks. These two 
blocks contain the program code, called the 'Boot code' needed to 'Boot' in the 
system and finder on the volume. 

On power up the Macintosh Roms load in these two blocks and execute 
them. The boot code performs several tasks such as system initialization, default 
global setups, memory initialization and executing the startup program. Usually 
the startup program is the Finder but this can be changed to any program on the 
volume. 



The First Part of the Boot Block is a Data Area and its structures are: 



0000 


word 


0002 


long 


0006 


word 


0008 


word 


OOOA 


16 


OOIA 


16 


002A 


16 


003A 


16 


004A 


16 


005A 


16 


006A 


16 


007A 


word 


007C 


word 


007E 


long 


0082 


long 


0086 


long 



$4C4B LK for Larry Kenyon 
Branch to the boot code 
version number of boot block 
flags 

Name of System File (System) 

Name of Program to run when leaving application (Usually Finder) 

Debugger Name (Macsbug) Loaded if present 

Name of Disassembler (Disassembler), Loaded if present 

Name of file for Startup Screen (Startup), Loaded and displayed 

Name of program to run after bootup (Usually Finder) 

Name of clipboard file (Clipboard) 

Number of File Control Blocks (FCB's) to allocate 

This is Max Files that can be opened. 
Max number of elements in event queue 
System heap size on 128k Mac 
System heap size on 256k Mac 
System heap size on 512k Mac 
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Appendix C 

Disk Volume Blocks 

The following information is on MFS volumes (Finder 4.1 or before). After this 
is some documentation on HPS volumes (Finder 5.0 or later). 

Block 2 on an MFS Macintosh volume contains the volume information and 
the first part of the allocation map. This allocation map extends into block 3, 
and beyond if needed. The number of blocks needed for the allocation map is 
determined by values in the first part of block 2, the information area. These 
values change for different size disks or hard disk volumes. 

The first area contains information about the volume such as its name, size, 
and creation date. The listing below shows the layout of the information: 



0 


Sig bytes for MFS Mac Disk $D2D7 


word 


2 


Date and time of initialization 


long word 


6 


Date and time of last update 


long word 


10 


Volume Attributes 


word 


12 


Number of files on volume 


word 


14 


First logical Block of Directory 


word 


16 


Number of logical blocks in directory 


word 


18 


Number of Allocation blocks on volume 


word 


20 


Size of allocation blocks, $400 normal 


long word 


24 


Number of bytes to allocate, $2000 normal 


long word 


28 


Logical Block # of 1st Alloc Blk $10 normal 


word 


30 


Next Unused file number 


long word 


34 


Number of unused Alloc blocks 


word 


36 


Length of Volume (disk) Name 


byte 


37 


Volume name goes here 


up to 23 bytes 




Previous information takes up 64 bytes 




64 


Allocation Block Table 






Starting at byte 64 of the volume information is the Allocation Block Table. 



Space on a disk is allocated to files in blocks of 1024 bytes (2 logical disk blocks). 
TTiis makes up to 400 different allocation blocks (800 disk blocks divided by 2 
disk blocks per allocation block) on a disk. The table has $187 hex or 391 entries 
with the entries starting at 2 and going to $189. Each entry is 12 bits long so in this 
case 586 bytes are needed. 586 = 391 (entries)* 12(bits/entry)/8(bits/byte) 

This example is for a single sided floppy. 
The value of any entry is : 0 Free allocation block 

1 Ending Allocation block for this file fork 

2-$l 89 Next Allocation Block in this linked list. 
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A file is a linked list of allocation blocks. The entry in a file directory points 
to the first allocation block of a fork and the value of that allocation blocks 

points to the next allocation block entry in the linked list etc When a 1 is 

encountered that is the end of the fork. 



For example: 

We display the file information for file Example 1 and we see: 
First Allocation Block of Data Fork :04 
First Allocation Block of Resource Fork :03 



We read in logical block 2 of the disk and we can refer to the block 
allocation table starting at relative byte 64 ($40 hex). The picture below shows 
the example. The first allocation block is 2. It does not start at 0 or 1 because of 
the significance of the values of 0 and 1 shown above. The values of allocation 
blocks 2 - 9 for this example are given below: 
Alloc Blk Value Comment 



2 


001 


final allocation block of a file 


3 


001 


final allocation block of a file 


4 


005 


next allocation block is 5 


5 


006 


next allocation block is 6 


6 


007 


next allocation block is 7 


7 


008 


next allocation block is 8 


8 


001 


final allocation block of this file 


9 


- 000 


Free allocation block 



00000010 
00000020 
00000030 
00000040 A 
00000050^ 
00000060 
00000070 
00000080 
00000090 
OOOOOOflO 
OOOOOOBO 

ooooooco 

OOOOOODO 
OOOOOOEO 
OOOOOOFO 
00000100 
00000110 
00000120 
00000130 
00000140 
00000150 
00000160 
00000170 
OCyinn ion 



000C0187 
00030180 
OOOOOQOO. 

00 100 too 

OOOOOODO" 
00000000 
000 
000 
000 
000 
000 
000 
000 
000 



77 5157FD 

00000400 
034D443 1 
UDOOOOOO 
5D060070 
Tinnnnrr^ 



Mac 

7 7 fl50040 

00002000 
31000000 
00000000 
08001000 



Zap 

00020004 
00100000 
00000000 
00000000 
00000000 
00000000 
00000000 



"oogwfloDwD.e 



UUUUUL 



Entrij 4doo 



For Data Fork, Start blk = 4|g 
Then 4 points to 5, 5 to 6, 
6 to 7, and 7 to 8. Entry 8 
has a value of 1 so end file 



00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
nnnnnnnn 



Logical Block 
2 is in buffer 



00000000 00000000 00000000 
00000000 00000000 00000000 
00000000 00000000 00000000 



^^^^^^^^ 



From File Infornnation 

Startinq Allocation Blk of Data >0004 
Starting Allocation Blk of Resource>0003 



8g start 



of Allocation Table^ Entry nunnber=:2 Value=1 
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HFS Volume Information 



The HFS disks can be recognized by a sig byte of $4244 instead of $D2D7. 
Finder 5.0 and above will format double sided disks with an HFS format. Single 
sided disks are usually MFS although they can be forced into an HFS format on 
rare cases. The volume info block contains the structure below: 



0 


Sig bytes for Mac Disk $4244 


word 


2 


Date and time of initialization 


long word 


6 


Date and time of last modification 


long word 


10 


Volume Attributes 


word 


12 


Number of files in root directory 


word 


14 


First block of volume bit map, 3 normal 


word 


16 


used internally 


word 


18 


Number of Allocation blocks on volume 


word 


20 


Size of allocation blocks, $200 normal 


long word 


24 


default clump size, $2000 normal 


long word 


28 


first block in bit map, 4 normal 


word 


30 


Next Unused file number or directory ID 


long word 


34 


Number of unused Alloc blocks 


word 


36 


Length of Volume (disk) Name 


byte 


37 


Volume name goes here 


up to 23 bytes 


64 


Date and time of last backup 


long 


68 


Used internally 


word 


70 


Volume write count 


long 


74 


Clump size of extents tree file 


long 


78 


Clump size of catalog tree file 


long 


82 


number of directories in root 


word 


84 


number of files on volume 


long 


88 


number of directories in volume 


long 


92 


Finder info 


32 bytes 


124 used internally 


6 bytes 


130 length of extents tree file 


long 


134 first 3 extent descriptors for extents tree 


12 bytes 


146 length of catalog tree file 


long 


150 first 3 extent descriptors for catalog tree 


12 bytes 
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The HFS structures are much more complex and require greater overhead 
of bookkeeping and management, what are its benefits?? For hard disk drives 
with hundreds or thousands of files it allows a better management of directories. 
All of the files do not need to be online or in one directory at once , yet they can 
all be accessed if need be by parsing through the binary tree. MPS disks with 
hundreds of files could take several minutes to manipulate the desktop, find a file 
etc. 

How the files are stored on a disk and their allocation methods have also 
been changed for HFS. This eliminates the need for one giant allocation table 
that must reside in memory. Very large drives now exceed 100 megs for the 
Macintosh. An MFS allocation table for a 100 Meg drive would require around 
90,000 bytes or 175 disk blocks, no small amount. 

The allocation table on MFS disks handles two different tasks. The first is 
the allocation of disk blocks, free or used. With the allocation table free disk 
blocks can be located because an entry of 0 means that allocation block and its 
associated disk blocks are unused. The second task of the allocation table is file 
mapping. The allocation table is made up of linked lists of allocation blocks. A 
file is 'Mapped* onto the disk via these linked lists. 

On HFS disks these two tasks have been split up into two separate structures. 
The allocation of disk blocks is now done with an allocation table of bits. The 
volume information block has an entry 'First block of Volume Bit Map'. This 
block, and as many more as needed, makes up the allocation table. Each bit in the 
table represents one allocation block. If the bit is set then the allocation block is 
used, if zero then it is free. 

The file mapping structures are stored in the file's directory entry and the 
extents tree file. Files are stored in extents, a contiguous series of allocation 
blocks. The first three extents of a file are stored in the file's directory storage 
and any overflow is stored in the extents tree file. 



See page 4 for a book covering HFS and MFS disk 
structures in more detail. 



63 



Appendix D 

DIRECTORY BLOCKS AND FILE STRUCTURE 



The following is on MFS Finder 4.1 or before. See the documentation after 
this for HPS Finder 5.0 or later. 

Data is store on a volume in a file structure. A master list of the files and 
information on each file is stored in the volume directory. The directory is made 
up of several blocks in a specific location on a volume, see Appendix C for 
location as it can vary. Usually the directory is made up of 12 blocks going from 
$4 to $0F on a Macintosh disk. Each block has 0-9 file entries stored on the 
block. Each file has an entry in the directory and its structure looks like: 



0 


File Flags normally $80 


byte 


1 


File Type 


byte 


2 


Finder Data 


16 bytes 


18 


File Number 


long word 


22 


First Allocation Block Data Fork 


word 


24 


Data Fork Logical end of file 


long word 


28 


Data Fork physical end of file 


long word 


32 


First Allocation Block Resource Fork 


word 


34 


Resource Fork Logical end of file 


long word 


38 


Resource Fork Physical end of file 


long word 


42 


File's creation date 


long word 


46 


File's last modification date 


long word 


50 


Length of Pile Name 


byte 


51 


File Name 



one byte 00 if needed to force next entry to word boundary 

A file has two forks, a Resource Fork and a Data Fork, and either one can 
be empty. An application program may only have a resource fork that contains a 
resource of type CODE. The two forks are stored separately and have different 
hooks in a file entry on a directory block. Each has a value in the file entry called 
'First Allocation Block' and this is the header of a linked list pointing to the rest 
of the fork. 

Allocation Blocks are not disk blocks!! A disk block is 512 bytes while an 
allocation block on a microfloppy is usually 1024 bytes. Note the usually, as it 
can be changed. The key word is allocation, this denotes the difference. Space on 
a floppy disk is allocated in blocks of 1024 bytes! For more information on 
allocation blocks see appendix C and the allocation table in the volume 
information area (MPS volumes). 
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When a file is created the information described above is put into a directory 
block. If the file is deleted all of this information is overwritten with zeroes. For 
any directory block all of the file entries are packed such that one entry follows 
another with no space between. This means that if a file is deleted the following 
entries are moved up in the block to pack against the other file entries. 

This system creates a problem for file recovery as all information on a file 
is removed from the directory blocks when it is deleted (empty the trash). The 
only information left is the file tag data, which eventually will not be supported. 

When a file is created or moved onto a volume several blocks are allocated to 
it from the pool of free blocks, A disk block is 512 bytes of storage for data or 
information and an additional 12 bytes for file data called TAGDATA, see below: 



0 File number Long word 

4 Fork Type (bitl = 1 if Resource) byte 

5 File Attributes byte 

6 File Sequence (Relative block) word 

8 Date of last modification Long Word 



When a file is deleted this information is not updated or removed. The 
blocks that were allocated to the deleted file are put back into the free block 
pool. The way part of our recover program works is to rebuild (by scanning all 
tag datas on a disk) the Data and Resource Forks of a given File number and then 
build these forks into a dummy file entry in the directory. 

HFS Structures 

File Directory entries on an HFS disk have similiar structures as above but 
their location on the disk and links between entries is quite different. The file 
Tags described above are the same for both MFS and HFS. 

The directory or Catalog of an HFS volume is not stored in the directory 
blocks (usually the first few blocks on MFS system). There is a special file called 
a catalog tree file, its internal structure is a binary tree. 

The catalog tree file is organized as a binary tree with the nodes being index 
nodes or leaf nodes. Index nodes have pointers to other nodes and a key value used 
in searching for an entry. Leaf nodes have the actual data used for file entries. 

The volume information block (Block 2) contains enough information for 
the operating system to access the first part of the catalog tree file. From there 
you can link or parse forward to the file/directory that you want. See the 
appendix on volume information for more. See the latest release of Apple's File 
Manager documentation for more information. However the File Manager does 
not go into enough detail for file and disk recovery. 

See page 4 for information on a book about Disk Structures. 
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Appendix E 

Macintosh RAM Memory 



@$108 
MemTop 



Contents (size in bytes) 



@$266 
SoundBase — ^— 



(§>$824 
ScrnBase 



@$10C 
BufPtr 



@$904 
Current A5 



@$908 
CurStackBase — 



A6 ■ 

Stack Pointer- A7" 



@$130 
ApplLimit — — 



@$114 
HeapEnd — 



@$2AA 
ApplZone — — 



@$2A6 
SysZone 



Used by System (28) 



Vlap 



Sound/Dis(< Speed Buffer (740) 



Used by System (128) 



Screen Buffer 



High Memory Area: 
Alternate Screen and Sound 
Buffers 



Jump Table 



Applhathn Parameters* (32) 



pointer to thePort 



Applbation Globals 



thePort 



Quickdraw Globals** (206) 




Stack 



**collision detection 
Growable Heap Zone 



Application Heap 



System f/eap 



Toolbox Dispatch Table (2048) 



More OS Globals (256) 



Toolbox Globals (768) 



OS Dispatch Table (1024) 



OS Globals (768) 



Trap Vectors (256) 



32(A5) 



Size 



$1400 

$C00 
$B00 

$800 

$400 

$100 
$00 



Screen and sound buffers are at fixed 
offsets from end of RAM. 

128k ROI^ Addresses: $400000 - $41 FFFF 

BufPtr defines tlie top of the Application Global 
Space (the "A5 world"). Initialized to point at 
bottom of Screen Buffer, BufPtr can be lowered 
to create room for Alternate Sound and Screen 
Buffers, or code that remains between 
applications. Many drivers now load in above Bufptr 
to reduce the loading and fragmentation 
In the System heap. 

Application Heap contains resources used 
by the application. Examples of these are 
window definitions, dialogs, text messages, icons, 
fonts, menus and many others. The Mac System 
also loads many temporary resources into the 
application heap. An example would be a desk 
accessory or a disk initialization package. The 
application program code is loaded in Code Segments, 
see below for more detail on code segments. 

Application Code Segments are loaded into the 
application Heap. Since they may load into different 
memory locations they need to be linked by a 
jump table. When a segment is loaded its jump 
table entries are set to the appropriate addresses. 

JUMP TABLE ENTRY for an extemally 
referenced routine. 



Unloaded State 



Loaded State 



Offset to this routine from 
the beginning of segment. 



Instruction that moves 
segment number onto stack. 



LoadSeg Trap 



segment # 
> bytes 



nstruction that jumps 
0 the address of 
his routine. 6 bytes. 



only 2 parameters are still used. 

0(A5) contains pointer to the first QD global 

16(A5) contains Finder startup handle 

'The location pointed to by A5 will always 
contain a pointer to the first QD global (thePort) 
even if not In the location shown here. Other QD 
globals can be referenced via negative offsets 
from thePort. 



60 times a second a stack sniffer 
looks for stack and heap collision. 
It will generate an error if detected. 



66 



Appendix F 

Tutorial 



TOOLS 

lZL 



Mac Zap Tools 

This tutorial will show you how to use Mac Zap Tools to edit disk volumes and 
files. We will search the disk for a target string and search a file for a target string. 



Disk Search 

When your Macintosh disk boots in, the screen shows a message saying 
'Welcome to Macintosh'. In this tutorial we will show you how to modify that 
message to say anything you want. 

We recommend that you use a copy of a disk to perform this tutorial and the disk 
that you modify needs to be a booting disk, one that has a system file on it. Once you 
are more comfortable with Mac Zap you can use original disks with safety. If you 
happen to inadvertently write a block where it shouldn't be written you may loose 
some data, that is why you should use a copy for this tutorial. 

The message printed on bootup has 'Welcome to* in it so we will search for this 
on the disk. Do the following: 

I I — I 



1) Insert the disk you want to use in a disk drive. Click on miDl until your disk name 
is displayed under the words 'Current Volume'. This is now the current volume 
where we will read/ write blocks. 

2) Under the Search pull down menu select Enter Ascii Search String and a dialog 
box will appear. Type in the search string Welcome to and click OK. 



3) Now under the Search pull down menu select Enter Search Range. 

Click on the All Disk control and then OK. Mac Zap will set the Search Range values 

'From' and 'To' for the entire disk. 



4) In the Search pull down menu select Search Disk, Mac Zap will find the Welcome 
to on the disk. Any blocks found containing this word will have their block number 
printed in the Data Window. The search is done when the menu bar option 'Search' is 
not highlighted anymore. The data window will appear something like the following: 

Search Disk For 57656C636F6D6520746F Welcome to 
0122001A 

The first line tells us that we are searching the disk and then gives the hex and 
ascii search string that we searched for. The next line is where any matches are 
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printed. Each match will be 8 characters. The first four characters are the relative 
location in the block of the search string and the next location is the block that the 
search string was found in. There could be multiple matches. 

Lets take the match 0122001 A which means that block $001 A (0122QQ1A) 
has the search string Welcome to and when that block is loaded into the buffer the 
word welcome is at $122 (Q122001 A). 

Note: When you do this tutorial on your disk you will have a different match number. 

Now, to modify the welcome message we would read in the disk block, click on 
the 'Welcome' message and type whatever we want. To do this: 



5) Select the Disk & File Window 



6) Make sure you are in Volume mode, the arrow should be next to the 
is hot, click in the empty box CH next to the disk icon and it will appear there. 



.If it 



7) Click on Disk Block, a dialog box appears. 

Click on Hex in the dialog box, we will enter the block number in hex. 
Enter OOIA and click OK. (Remember you will have a different number.) 



8) Click on Read Disk Block 

9) Select the Main Window 



10) Now locate the message Welcome to Macintosh in the main window display 
screen, it will be on the right in the ASCII area. To modify the message position the 
mouse over the W in Welcome and click to put the input cursor there. Then type in 
what you want the message to be. Be sure not to write in the memory before or after 
the regular message of 'Welcome To Macintosh' as this memory is used for other 
purposes. 

Once you have modified the message you can write it back to disk by: 



1 1) Select the Disk & File Window 

12) Click on Al (unlock write control) 

13) Click on Write Disk Block (write the block back out) 

14) Click on rf* (Lock the disk backup) 



The disk is now personalized with your message, boot the disk and see. 
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File Search 

When your Macintosh disk boots in, the screen shows a message saying 
'Welcome to Macintosh'. In this tutorial we will show you how to modify that 
message to say anything you want 

Sounds familiar? In the previous tutorial we searched an entire disk for this 
message and modified it. This message is contained in the 'System' file on the disk, it 
is part of the Macintosh startup sequence. Now we are going to search the 'System' 
file and modify the welcome message. A disk is made up of files. Therefore we could 
search the entire disk and find the message, or we could search a file (assuming we 
know which file) and find it. 

We recommend that you use a copy of a disk to perform this tutorial and the disk 
that you modify needs to be a booting disk, one that has a system file on it. Do not use 
the modified disk we made in the previous tutorial, start fresh again. Once you are 
more comfortable with Mac Zap you can use original disks with safety. If you happen 
to inadvertently write a block where it shouldn't be written you may loose some data, 
that is why you should use a copy for this tutorial. 

Insert die disk you want to use in a disk drive. The message printed on bootup 
has 'Welcome to' in it so we will search for this in the file. Do the following: 

1) Under the Search pull down menu select Enter Ascii Search String and a dialog 
box will appear. Type in the search string Welcome to and click OK. 

2) Under the ExtraiFile pull down menu select Search File. A standard file select 
dialog appears, click the drive button until you are looking at the disk just inserted. 
Now select the file 'System', this is where the 'Welcome to' message is stored as a 
resource. Mac Zap will search the file, any matches it finds will be printed in the data 
window. The data window will appear something like the following: 

Search File For 57656C636F6D6520746F Welcome to 
00000180 

The first Hne tells us that we are searching a file and then gives the hex and ascii 
search string that we searched for. The next line is where any matches are printed. 
Each mach will be a long word (8 characters). There could be multiple matches. 

In our case the match was $00000180, this is the offset from the beginning of 
the file where the message 'Welcome to' starts. 

Note: When you do this tutorial on your disk you will have a different match number. 

Now, To modify the welcome message we would read in the part of the file 
containing $0180, click on the Welcome message and type whatever we want. To do this: 
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3) Select the Disk & File Window 




4) Click on the oil-) to open a file. A standard file select dialog box will appear. Click 
on the drive control until you are looking at the disk you just inserted. Select the file 
'System'. You have just opened the file 'System' for Editing. 

5) Click on File Position, a dialog . box appears. 

Click on Hex in the dialog box, we will enter the file position in hex. 

Enter QQ0QQ18Q and click OK. (Remember you will have a different number.) 

6) Click on Read File Block 

7) Select the Main Window 

8) Now locate the message Welcome to Macintosh in the main window display 
screen, it will be on the right in the ASCII area. To modify the message position the 
mouse over the W in Welcome and click to put the input cursor there. Then type in 
what you want the message to be. Be sure not to write in the memory before or after 
the regular message of 'Welcome To Macintosh' as this memory is used for other 
purposes. 

Once you have modified the message you can write it back to disk by: 

9) Select the Disk & File Window 

10) Click on A (unlock write control) 

11) Click on Write File Block (write the file block back out) 

12) Click on (Lock the disk backup) 



13) Click on a_J and when the file select dialog box appears click Cancel. This will 
close the file 'System'. Mac Zap no longer has the file open for editing. 

The disk is now personalized with your message. 

NOTE: We just edited the system file on a disk. We could not edit the system file on 
the disk that we booted from because it is currently open for editing (read/write) by 
the Mac Operating system. There cannot be two programs with write privileges to 
the same file (normally). Mac Zap will not open a file for editing that already is open 
for editing. 
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Mac Zap Features 



Mac Zap Recover 

Recovers crashed Disks and Files. 
Compatible with all MFS and HPS Hard disks. 
Compatible with Single and Double Sided Floppy Disks. 
Compatible with Logical File Volumes such as Mac Serve. 
Bulletin Board Support. 
SCSI Support. 

Mac Zap Tools 

Compatible with MFS and HFS. 
Disk and File editor. 
Edit File Attributes. 
Memory Editor. 
* • Disassembler with Trap Names. 

Volume Allocation Maps for MFS and HFS. 

File Allocation Maps for MFS and HFS. 

Make File Storage Contiguous, Faster Disk Use. 

File Resource Maps. 

Search & Compare Files or Disks. 

Search Memory. 

Full SCSI Support, Read/Write ANY block on a SCSI. 

Graphics Display. 

MORE!!! 

Mac Zap Patcher 

Install Protected Programs to Hard Disk. 
Compatible with all Hard Disks. 
Bulletin Board Support. 

Mac Zap Copy 

Backup Protected Programs. 

Block Mode and Track (Bit Copy) Mode 

Track Editor 

Single or Double Sided Disks. 

Fast Disk Copy 

FAST Disk and File Duplication. 
Compatible with MFS and HFS. 
Single or Double Sided Disks. 



